fc52409b015f0c3ba4e8aad1e9cd0ee4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fc52409b015f0c3ba4e8aad1e9cd0ee4_JaffaCakes118
Size

6KB
MD5

fc52409b015f0c3ba4e8aad1e9cd0ee4
SHA1

48cd547166f593601a69d1e495e0490af4d51aa2
SHA256

a96b84d66264ba6b9ba306f9c2dab2bc8fedbe153ba16683cbbaf4f0d0c65d0a
SHA512

e0c53dc7040b5040c63ad235ee71a4fbab231467fd0446320e4e48e0d74fc7eff003afe1285de61a573e0812e841133653bbd32916bd28f42472ef3e0b634f69
SSDEEP

96:PuHhN1ig1iO4g0IaoPfbmpoJj/213BcGZWOtV:PuBNYIi80xkmpYSWA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fc52409b015f0c3ba4e8aad1e9cd0ee4_JaffaCakes118

Files

fc52409b015f0c3ba4e8aad1e9cd0ee4_JaffaCakes118
.dll windows:4 windows x86 arch:x86

84a2415e0fec8ac9352e1b97a87a26a5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenA
OpenProcess
FreeLibrary
CloseHandle
VirtualAllocEx
LoadLibraryA
GetSystemDirectoryA
CreateThread
WriteProcessMemory
GetModuleHandleA
GetProcAddress
CreateRemoteThread
Sleep
GetCurrentProcess

advapi32

SetServiceStatus
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegisterServiceCtrlHandlerA

msvcrt

_initterm
malloc
_adjust_fdiv
_stricmp
free

Exports

Exports

ServiceMain

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 829B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ