ffe99b2923bd070a3eda9a088ac557c9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ffe99b2923bd070a3eda9a088ac557c9_JaffaCakes118
Size

50KB
MD5

ffe99b2923bd070a3eda9a088ac557c9
SHA1

ed7f191969cbf4ab2be525ae6f18a3ec1b5b948b
SHA256

fe4b99fcd786076059a8480ba3e0e238f3600d5b87cdabea8c8b8e2bf485a96a
SHA512

8035c5743ec2ecdc144dadb59b875df8aaf7142ddab348df4e8b417b239263779ff13f8e81a104698bd9335cc8bb16c4c37996e8f18dcac99397e7d4b2b05898
SSDEEP

1536:PLUtid7Sx34PqXNd5ru4Vey+RlakiDngvH+srcELVddJ:TUtiNSVYIr5LVe+0drcy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffe99b2923bd070a3eda9a088ac557c9_JaffaCakes118

Files

ffe99b2923bd070a3eda9a088ac557c9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

29d4d9a4e535bff721362e89820bef9e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 39KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE