ff047104891f63df86db03ce8b316666_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ff047104891f63df86db03ce8b316666_JaffaCakes118
Size

6KB
MD5

ff047104891f63df86db03ce8b316666
SHA1

a70e60f9d2bd3952b9155c4e7e68b15b8ce2fb37
SHA256

1172c88c60e0f8d619a7ed539423fa62f71341c9795d199c66677d9c058389f9
SHA512

f749806b7c5332a988d30a494b2ad84c0cafb84c13d1c13f70665cce9413829e3ab1715d765f128208c25043273814ebca939b0ff76a8d2df50edc6199ede882
SSDEEP

96:pr1RPVW+cuM6z8FpOV6X2+i+gaul3UCJT5lc2BVleCTrcypdO:1kcq6m23+XuVUR2bleC3cd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff047104891f63df86db03ce8b316666_JaffaCakes118

Files

ff047104891f63df86db03ce8b316666_JaffaCakes118
.exe windows:4 windows x86 arch:x86

77848d9a50889053eb74df459822b159

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetWindowDC
MessageBoxA
GetDesktopWindow
DrawTextA

kernel32

Process32Next
lstrcpynA
lstrcpyA
lstrcmpiA
CloseHandle
CreateFileA
CreateToolhelp32Snapshot
DeleteFileA
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
GetCurrentProcessId
GetFileSize
GetProcAddress
LoadLibraryA
LocalAlloc
LocalFree
MoveFileA
OpenProcess
Process32First
lstrcatA
ReadFile
RtlZeroMemory
SetFilePointer
TerminateProcess
WriteFile
lstrlenA

ntdll

RtlAdjustPrivilege

shell32

SHGetPathFromIDListA
SHBrowseForFolderA

ole32

CoTaskMemFree

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE