ffa22be786b04671a3ca9142879a1b2d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ffa22be786b04671a3ca9142879a1b2d_JaffaCakes118
Size

240KB
MD5

ffa22be786b04671a3ca9142879a1b2d
SHA1

dad0e0a8f1c98d466aca8305fed6c4ba3197ec31
SHA256

5e34e2272ff70a036bdd0260dbb7334701e379b22ad7d478727e49f8e7fc897c
SHA512

7ff8e1830ecf64ce241572fdb0a28828682f5ebb9962bb09e8f5e3715c2755796be94c96c08b703fb919ddf2517b0902ae85ad2cc94b32c37760ac28782298d8
SSDEEP

6144:wbx4KycLIwXAjbma/T/Z6TbqgTJo9LaQIyGIAsI:fKbIRjaaL/Z6aYQIyG9T

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffa22be786b04671a3ca9142879a1b2d_JaffaCakes118

Files

ffa22be786b04671a3ca9142879a1b2d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5b0b14069590e87d20575f66f45af95d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtect
LoadLibraryA
VirtualAlloc
Heap32ListFirst
GetEnvironmentVariableW
GetProcAddress
VirtualFree
Sleep

user32

GetMessagePos
SendMessageA

wininet

InternetCloseHandle
FtpPutFileA

ole32

CoInitialize
CoInitializeEx
OleInitialize

advapi32

RegEnumValueA

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 209KB - Virtual size: 209KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE