3e285cc4343fb7ad0354f6f805483740_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3e285cc4343fb7ad0354f6f805483740_JaffaCakes118
Size

18KB
MD5

3e285cc4343fb7ad0354f6f805483740
SHA1

4e2e2b3aa6ad60c33066d7851b1700ed1e28d5bd
SHA256

2e0e8697e7130041e0a0b8725edd68c32c5781bac2acbdbeeb48628165f275d8
SHA512

67f37678d6f2dba5f5bd7959662656ec73d85fe3811cf87ffe05eb2f13a12a86a46161abce42c763a7b8b7aa423973b27921f67d7614fbc72f347d2adde8d440
SSDEEP

384:erDKFb+tnPWjtLf8zvLOk6+6nI60viTOZG:eqatnPWjtLfdH+6nIXv6OZG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e285cc4343fb7ad0354f6f805483740_JaffaCakes118

Files

3e285cc4343fb7ad0354f6f805483740_JaffaCakes118
.dll windows:4 windows x86 arch:x86

081815873c93765c7fad3f3482b5e157

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateProcessA
WriteFile
GetTempPathA
GetLocalTime
GetCPInfoExA
GetACP
CreateFileA
SetThreadPriority
CreateThread
GetModuleFileNameA
DisableThreadLibraryCalls
VirtualAlloc
VirtualFree
GetLastError
CloseHandle
GetSystemDirectoryA
DeleteFileA
Sleep
LoadLibraryA
TerminateThread
GetProcAddress

user32

GetCursor

wininet

HttpQueryInfoA
InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle

gdi32

GetPixel

advapi32

OpenSCManagerA
CloseServiceHandle
ControlService
OpenServiceA
DeleteService

shell32

ShellExecuteExA

msvcrt

memset
strcat
strcpy
sprintf
strrchr
strlen
_except_handler3
memcpy

Exports

Exports

DriverProc
modMessage
modmCallback

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 342B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ