ffc1b9fbe30a58ab6a1557beb4b199e6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ffc1b9fbe30a58ab6a1557beb4b199e6_JaffaCakes118
Size

3KB
MD5

ffc1b9fbe30a58ab6a1557beb4b199e6
SHA1

dc05e563c483095ca3f841dd42bff064345fd927
SHA256

32e784f78f810e69ef34a869eacd6ca4b2b29760390c6812406c72cf98537711
SHA512

38c31ed5748fabb49d4dc4b8d9824bbb95443c779032f7c1fd96e2e262d3c1fa01b1a5cc4cf45e986c853a732b7c65ced19db3b4eacb7932d138fa1f06655571

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffc1b9fbe30a58ab6a1557beb4b199e6_JaffaCakes118

Files

ffc1b9fbe30a58ab6a1557beb4b199e6_JaffaCakes118
.exe windows:5 windows x86 arch:x86

c2447b835385b322d78a3e011389e9ae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcessId
GetSystemTime
DeviceIoControl
lstrcpyA
Module32First
CreateEventA
GetSystemDefaultLangID
GetCurrentProcess
GetCurrentThreadId
LoadLibraryA
GetCurrentThread
GetThreadLocale
DisableThreadLibraryCalls
GlobalAddAtomA
TerminateThread
VirtualAlloc
WaitForSingleObject
GetProcAddress
IsBadReadPtr
VirtualProtectEx
VirtualFree
GetModuleHandleA
Sleep
SystemTimeToFileTime
GetThreadTimes

user32

GetLastActivePopup
GetFocus
GetWindowTextLengthA
GetDlgItem
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
UpdateWindow
ShowWindow
MessageBoxA
CreateWindowExA
RegisterClassExA
LoadCursorA
LoadIconA

Sections

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 700KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 173KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ