dc46ea829c96405f01520fd6dbfdd8ac_JaffaCakes118 | Triage

Sharing

General

Target

dc46ea829c96405f01520fd6dbfdd8ac_JaffaCakes118
Size

24KB
MD5

dc46ea829c96405f01520fd6dbfdd8ac
SHA1

a366cc00d54747c8ea0355ab9c12ee3a8c09a2ac
SHA256

5b59d64659d79e6bb4079ea485b07cd49bfe0c0e4ae87fab6c1f390c5eddc8e5
SHA512

0be3cec4e076f7a246fd46c495d1e804d4a5d0f7775fe688604a8410a5eef0eb96a0f42616d6ce0e5ad159a2dfe2cc0c24c562692ccbecb3c0b8d1f22ae5003f
SSDEEP

192:3wK1MnQDqr23Z2JuBBQ6PRQkbsebCSmMJjAa0b4:gK1MnQL3ZEuBBQARQk4ECSmMxL0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dc46ea829c96405f01520fd6dbfdd8ac_JaffaCakes118

Files

dc46ea829c96405f01520fd6dbfdd8ac_JaffaCakes118
.dll windows:4 windows x86 arch:x86

77ce9c2be7316a6dfcb830c33a405b34

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
GetProcAddress
LoadLibraryA
lstrcatA
CloseHandle
VirtualProtect
GetModuleFileNameA
CreateThread
Sleep
ExitProcess
GetCurrentDirectoryA
lstrlenA

user32

CallNextHookEx
SetTimer
KillTimer
SetWindowsHookExA
UnhookWindowsHookEx
wsprintfA

wininet

InternetCloseHandle
InternetOpenA
InternetOpenUrlA
InternetReadFile

ws2_32

gethostname

msvcrt

memset
_adjust_fdiv
malloc
_initterm
free
fclose
fread
fputs
fopen
strcat
exit
memcmp
strcpy
strcmp
strlen
memcpy
strrchr

ntdll

_strlwr
_itoa

Exports

Exports

StartServiceEx
StopServiceEx
_ServiceRouteEx@12

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 746B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ