efa35d4e045b66d268ed56baed22addd_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

efa35d4e045b66d268ed56baed22addd_JaffaCakes118
Size

24KB
MD5

efa35d4e045b66d268ed56baed22addd
SHA1

e03cbe1d9791a8759cba366bdb7fda1f726a7a40
SHA256

8dc1f231efd633c75ddaebc0d1691d64242ba76679ab6daf69872f5abeff88d1
SHA512

8b5f1ad6adc7b32efdc787156b24a4e264a6543d75d256e0c915215d1c1f0e7836c175c671b3470592437bf8cedcdb35157151abb153d83d0909c1a55308a74a
SSDEEP

192:dDs4U7hieMeZNs3t1L4E+afj+6i+kRwi0q3:CNQ4Erj+6i+Giq3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
efa35d4e045b66d268ed56baed22addd_JaffaCakes118

Files

efa35d4e045b66d268ed56baed22addd_JaffaCakes118
.dll windows:4 windows x86 arch:x86

566f296ea037b989515e4fc54d3e2327

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord1168

msvcrt

_adjust_fdiv
malloc
_initterm
free
exit
_stricmp

kernel32

FreeLibrary
Sleep
GetSystemDirectoryA
GetProcAddress
LoadLibraryA
Process32Next
GetCurrentProcessId
CreateThread
CreateToolhelp32Snapshot
lstrcmpiA
TerminateProcess
OpenProcess
DeleteFileA
Process32First

advapi32

RegOpenKeyA
RegCreateKeyA
CreateServiceA
DeleteService
StartServiceA
OpenSCManagerA
OpenServiceA
ControlService
CloseServiceHandle
RegSetValueExA
RegCloseKey

Sections

.text
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ