ff3c9a3fbf70daef6cc4fde23ac11174_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ff3c9a3fbf70daef6cc4fde23ac11174_JaffaCakes118
Size

304KB
MD5

ff3c9a3fbf70daef6cc4fde23ac11174
SHA1

3b6a643d8c6335e46c987934e70e146105c9139f
SHA256

d52248e2d7900fd4ca97fa021ff53bfc3a8381a4321e80f4a126a7e1c56a1e7c
SHA512

55f3a8a506e827e69da94e539a9c5b79878524762e3446a8bb752ad180f61b20d1da89ea42165e2668f353f4f7c650e7ababc5e21f9e226e0af9bc4dceaf4522
SSDEEP

6144:aqtgdEOqDEg7tB6qBb3ei+VEbJlZJbnofbHpzH6Hw7Kx6ja4JX:aqtguDDEg7f6yewbJlZlnofVrUR6jB5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff3c9a3fbf70daef6cc4fde23ac11174_JaffaCakes118

Files

ff3c9a3fbf70daef6cc4fde23ac11174_JaffaCakes118
.exe windows:5 windows x86 arch:x86

12bb9f4be97a3ced0bb621c15ca5ae6c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
lstrcmpiA
GetPrivateProfileIntW
lstrcmpA
GetDiskFreeSpaceA
GetPrivateProfileSectionA
Sleep
GetDiskFreeSpaceA
Sleep
Sleep
WaitForMultipleObjects
HeapCreate
GetExitCodeProcess
GetPrivateProfileIntW
InterlockedExchange
GetFileAttributesA
InterlockedIncrement
SetEnvironmentVariableW
CreateDirectoryA
GetLongPathNameW
SetFilePointer
LoadLibraryExW
FindResourceW

catsrv

CreateComponentLibraryTS
DllCanUnloadNow
GetCatalogCRMClerk
OpenComponentLibraryTS

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 297KB - Virtual size: 297KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE