ff7ed8875c109665aab23f4dfd50731c_JaffaCakes118 | Triage

Sharing

General

Target

ff7ed8875c109665aab23f4dfd50731c_JaffaCakes118
Size

2.6MB
MD5

ff7ed8875c109665aab23f4dfd50731c
SHA1

91c2cecbf7f892cad3c740a0186b323e1c4bc97f
SHA256

d0bbcc3be188e7adb831f403d8d6c78f483fec83519aa3e5a3bc6eafacc860db
SHA512

b6328064882ebd6cd82610c267cdeb443af259d1299b6c0016b1506e096191e09f10750ab3894a487de203b9e965938cf566b28bade076b7eea8ac7a266d64ca
SSDEEP

49152:fAIVacea6J0F8zuje8/q9YV2VTGHtoMIdO3GmgVMhl6q7s+0lhmY+TxblNG5C:fAh5J0F8lroHtoM0O3jgos6Y+TdlNGQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff7ed8875c109665aab23f4dfd50731c_JaffaCakes118

Files

ff7ed8875c109665aab23f4dfd50731c_JaffaCakes118
.dll windows:4 windows x86 arch:x86

031bf3f666d0ae91bda4d2c096c30af5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetCurrentProcess
OutputDebugStringA
RegisterConsoleVDM
ReadConsoleOutputAttribute
GetProcAddress
lstrlenA
CompareStringA
ReplaceFileA
GetCommandLineA
ExitProcess
GetStartupInfoA

Sections

itext
Size: 4KB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

idata
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ