ff0ed00de7eadd4f2289c76079dc9f5c_JaffaCakes118 | Triage

Sharing

General

Target

ff0ed00de7eadd4f2289c76079dc9f5c_JaffaCakes118
Size

287KB
MD5

ff0ed00de7eadd4f2289c76079dc9f5c
SHA1

30a4d26a06ba181d331c8689e4653b744a41ed39
SHA256

0c041e2061321a76988b153f7481218b9ad2f6344d77e2c56dc9d9f00f0b6c38
SHA512

78a1d92a2c28670250b6786f4b417995842b1b023d7abad073f11f9715ad8b4d33fb38b61c4f274a21aff1129b3ae02003b3945c1cf5dbd3c3beba582d520517
SSDEEP

6144:Go1FIFXMCrFP3PAANM5IaE1pqcNKKP9rWrPUypGDbkGkSJlEbh2pCuv:zc5h/AAu5ITpqcNEL8bYSJlEbh2z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff0ed00de7eadd4f2289c76079dc9f5c_JaffaCakes118

Files

ff0ed00de7eadd4f2289c76079dc9f5c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

da2529e50eafb55e2b4f7e1d27da4c87

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForSingleObject
CreateProcessA
CloseHandle
WriteFile
CreateFileA
lstrcatA
lstrlenA
GetTempFileNameA
lstrcmpA
GetTempPathA
ExitProcess
GetCurrentThreadId
GlobalAlloc
FreeLibrary
GetProcAddress
LoadLibraryA
VirtualQueryEx
GetModuleHandleA
GetThreadContext
GlobalFree
TerminateProcess
ResumeThread
VirtualFree
OpenProcess
VirtualAlloc
lstrcpyA

user32

wsprintfA
OpenInputDesktop
GetThreadDesktop
SetThreadDesktop
GetWindowThreadProcessId
CloseDesktop
FindWindowA

shlwapi

SHGetValueA

advapi32

CreateProcessAsUserA
OpenProcessToken

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 276KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE