ffa4643c34dca30ce3b66776afcdd492_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ffa4643c34dca30ce3b66776afcdd492_JaffaCakes118
Size

612KB
MD5

ffa4643c34dca30ce3b66776afcdd492
SHA1

ee40bf8fc44c157aaf1363dc9b69eaf2d09e1d03
SHA256

c8903f6512d0488bd9fc6eea595398c1b5eb6f9cf789999d89972b4b4a365fbc
SHA512

5e90faaef2ebdff544b0f0874db369312bb34346fafaf1c3d8bcebdb1bfa796a2d23998ff44337f791bde8e15d54e688a3420701bee9cb32b41328fa3fcaa46b
SSDEEP

12288:tdWAK4vQVdTmxsjP5VbbnjC/LF3nq+Ac4CUC3h83hjRHk6/u:/bKAYualRDm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffa4643c34dca30ce3b66776afcdd492_JaffaCakes118

Files

ffa4643c34dca30ce3b66776afcdd492_JaffaCakes118
.exe windows:4 windows x86 arch:x86

52dc3cb817c7d246af18fa8dc7c8b9b8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
longjmp
_exit
_XcptFilter
sprintf

kernel32

GetLastError
FreeLibrary
GetSystemTime
GetModuleFileNameA
GetModuleHandleA
GetEnvironmentVariableA
InterlockedExchange
Sleep
LoadLibraryA
GetProcAddress
GetCommandLineA
WinExec

user32

CharUpperA
MessageBoxA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

Exports

Exports

_mFdllinfo

Sections

.text
Size: 588KB - Virtual size: 584KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE