ff3049ce24c0e435d8b07524f7735f1f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ff3049ce24c0e435d8b07524f7735f1f_JaffaCakes118
Size

499KB
MD5

ff3049ce24c0e435d8b07524f7735f1f
SHA1

187b1dfe0a2d072c4dc1f71c62d8e3a0077d731b
SHA256

c562514e43ce17941130365f1e5aab2859a2a1112ff17e9a2499fac62eb9d45b
SHA512

0764e509d791f922f87a66c6633b44a811c3cb533dfccc0e68e1391853b9d293e2d36433c769ee9021e2eeefaa4f6e3dc77c34f1be6d1d114fc8a74f8c89d245
SSDEEP

6144:2DhvkZ8gulzV2V9/H5DTwaHd6dcNiXPnpUTJPyd+MElqwkp7:2lMZu2z96dcYXPnpcJPydjZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff3049ce24c0e435d8b07524f7735f1f_JaffaCakes118

Files

ff3049ce24c0e435d8b07524f7735f1f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

beb9ee4934f14bfb66c40f90a0dc528b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CancelIo
ReleaseMutex
GetModuleHandleA
CreateFileA
IsBadStringPtrA
GetModuleFileNameA
GetDriveTypeA
TlsGetValue
SuspendThread
HeapCreate
lstrlenA
ResumeThread
PulseEvent
IsDebuggerPresent
DeviceIoControl
CreateFileMappingA
GetStartupInfoA
GetACP
TlsAlloc
DeleteFileA

user32

DestroyMenu
DrawTextW
CallWindowProcW
FindWindowW
IsWindow
PeekMessageA
DispatchMessageA
GetIconInfo
DestroyWindow
GetWindowLongA
IsZoomed
LoadImageA
DispatchMessageA

amstream

DllRegisterServer
DllRegisterServer
DllRegisterServer
DllRegisterServer

cryptui

LocalEnroll

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 408KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 491KB - Virtual size: 490KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ