fc28edc60eefd03003ec2075542fd8c2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fc28edc60eefd03003ec2075542fd8c2_JaffaCakes118
Size

32KB
MD5

fc28edc60eefd03003ec2075542fd8c2
SHA1

df3910a27dbadf505f3e34bb3b2f5f1379922274
SHA256

670bd1cfe444a794bc89a5435d48a85df7eb05b9b40efd16ba25289386039c35
SHA512

b9caf1b97f248eb4a9f89e17ada3269aed169355aedc46a228837adfb5907d7046b2e74cf777c8e238fb717a2b880ceb3d68a67d98c3cf582007dfc33b6b1180
SSDEEP

384:xpXrH0qDENpAX84H6F3kVSZmLgmxNxRB04GUDdvz1GvT:xpbHXDueX8w6iV9UWxRBlGubK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fc28edc60eefd03003ec2075542fd8c2_JaffaCakes118

Files

fc28edc60eefd03003ec2075542fd8c2_JaffaCakes118
.dll windows:4 windows x86 arch:x86

1f9b9892c064f86e969e46729e463687

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
GetLocalTime
GetStartupInfoA
lstrcatA
FreeLibrary
lstrcpyA
WinExec
FreeConsole
DisableThreadLibraryCalls
LoadLibraryA
lstrlenA
GetProcAddress

user32

wsprintfA

advapi32

RegisterServiceCtrlHandlerA
SetServiceStatus

wininet

InternetCloseHandle

msvcrt

wcstombs
_adjust_fdiv
??3@YAXPAX@Z
malloc
atoi
sscanf
rand
strncmp
strtok
strstr
isspace
strncpy
__dllonexit
_onexit
free
_initterm

ws2_32

WSAStartup
gethostname
inet_addr

Exports

Exports

ServiceMain

Sections

.text
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 662B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ