ff2493ea71c877f34b1554dac50bffd8_JaffaCakes118 | Triage

Sharing

General

Target

ff2493ea71c877f34b1554dac50bffd8_JaffaCakes118
Size

333KB
MD5

ff2493ea71c877f34b1554dac50bffd8
SHA1

63bb0617543d3c0b1aa1400f0e64a6dc4865466c
SHA256

c270571051bb97859e30e4326af910eef3c50fd9d9096821d7e57cd77b1915c7
SHA512

19b76756637cb4da631ec772d12ef8f9f25a8220132454435c30bed870956a730e0db776a1edb973c6fa8ce0529a91e44c646c5ad9c304f5ac3ddb251392cf39
SSDEEP

3072:3d+vFsKuwPROUV5KDy5gxGxdWKb9Joag9cBrCUwsyg5yalqu5BOJoSW+FQZLe+gR:NVyF5Ohox1b9JoazLplTMoSWp/gUte

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff2493ea71c877f34b1554dac50bffd8_JaffaCakes118

Files

ff2493ea71c877f34b1554dac50bffd8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c3a6c854b31722b6262629f937704138

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReleaseMutex
lstrcmpiA
GetModuleHandleA
GetLastError
GetDiskFreeSpaceA
CloseHandle
DeleteCriticalSection
CreateHardLinkA
GetTickCount
AddAtomA
VirtualProtect
HeapDestroy
SearchPathA
SetEvent
TlsGetValue
Sleep
ResumeThread
GetThreadLocale
ExitProcess
GetStartupInfoA

advapi32

IsValidSid
AccessCheck
CloseEventLog
CloseTrace
RegEnumKeyExA
FreeSid
RegLoadKeyA
LsaFreeMemory
LsaSetSecret
OpenEventLogA
GetFileSecurityA
LsaClose
RegCloseKey
RegCreateKeyExA

cfgmgr32

CM_Delete_Range
CM_First_Range
CM_Get_Child
CM_Add_IDA
CM_Add_Range

shell32

DragQueryFileA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 792KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ