ff7696dfda0ccd0c88f5b9083f87f034_JaffaCakes118 | Triage

Sharing

General

Target

ff7696dfda0ccd0c88f5b9083f87f034_JaffaCakes118
Size

164KB
MD5

ff7696dfda0ccd0c88f5b9083f87f034
SHA1

0e5566e885b9f7a2a90dfa574f47fa6025a7d580
SHA256

839f289337dbbcb572d6d6f215103465aa72c4ace65b826ca54a5dfbab024137
SHA512

7032b6fd900f55a7351d9359d0e3912dd6ad2f50c72222208831cce8beb67d4ff5b3490072d0c5e58aca204dde87d6335671999b2857c128d23570508869d892
SSDEEP

3072:L1Z9EvxJHffkpWt8np0BaD3y2W95BOCPs1PV7d4u7+c36z7tX:eNKOqEbG1PV7vVM7tX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff7696dfda0ccd0c88f5b9083f87f034_JaffaCakes118

Files

ff7696dfda0ccd0c88f5b9083f87f034_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6c0ba9ebfb93e35509d11f734388ffc9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

UrlCombineW
UrlGetPartW
UrlCanonicalizeW
UrlApplySchemeW
PathCombineW
PathAppendW

oleacc

LresultFromObject
AccessibleObjectFromEvent

msimg32

TransparentBlt

kernel32

LCMapStringW
HeapFree
GetStringTypeA
IsDebuggerPresent
GetCurrentProcess
InterlockedExchange
GetCPInfo
RtlUnwind
GetACP
WriteFile
EnumResourceTypesW
SetUnhandledExceptionFilter
ResetWriteWatch
GetOEMCP
LCMapStringA
LoadLibraryA
GetStringTypeW
VirtualAlloc
GetLocaleInfoA

wtsapi32

WTSFreeMemory
WTSUnRegisterSessionNotification
WTSQuerySessionInformationW
WTSEnumerateSessionsW
WTSRegisterSessionNotification

Sections

.text
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 405KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ