ff004d8ba68712285f86196b08264555_JaffaCakes118 | Triage

Sharing

General

Target

ff004d8ba68712285f86196b08264555_JaffaCakes118
Size

41KB
MD5

ff004d8ba68712285f86196b08264555
SHA1

9371874536a664f9951375290fac38041f95bddc
SHA256

38cc37ea804a24e9c2f384678d266c3d22f2d76e4bfb24049ed701b6d98ed01e
SHA512

4ee1091da9b9773df4817b0febcfb97187f4b436cb45070539b668b3c0cfcf8fc2cf2eec0eb928e3add8911a8c8cb175a68bba89923194d594b33ca65aaf4abd
SSDEEP

768:dX6ien2LoGVbADfMyKY3f3hqOkp1ThY8IlGNO2bDaV/iGAk:9hHFAlxqOkrTa8IlGsw6B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff004d8ba68712285f86196b08264555_JaffaCakes118

Files

ff004d8ba68712285f86196b08264555_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8ed3fcad6d0e50f4f8bb96fc778e194f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
WriteFile
CreateFileA
LockResource
LoadResource
SizeofResource
FindResourceA
GetModuleHandleA
UnmapViewOfFile
FlushViewOfFile
GetFileSize
MapViewOfFile
CreateFileMappingA
Sleep
DeleteFileA
TerminateProcess
OpenProcess
WinExec
GetCurrentProcessId
CopyFileA
GetTempFileNameA
GetTempPathA
GetWindowsDirectoryA
GetModuleFileNameA

shlwapi

PathFileExistsA

msvcrt

__p___initenv
__dllonexit
time
_mbsupr
sprintf
_ltoa
atoi
_mbsrchr
_except_handler3
_exit
_XcptFilter
exit
_onexit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp

rpcrt4

UuidCreate
RpcStringFreeA
UuidToStringA

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ