06f925683872be032e6fe721840cd048_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

06f925683872be032e6fe721840cd048_JaffaCakes118
Size

313KB
MD5

06f925683872be032e6fe721840cd048
SHA1

f841ef0636c30774d8491a6f592e2cb2ba1a5467
SHA256

fddf5be03a52cb2bb796cfaae56ccf28d9f1b5927d8e315bb543b5099220c830
SHA512

0cd8891151f9866354b638750492f66576d38253a27b37c4fd93718b1211808ee060eae52e17a044106ddc754eae33099ad256df8eb6f780a6266dadb51af1e4
SSDEEP

6144:tmrsPRQ3mOAovuxZFKvXV1EweMYH/KydzlUJbTRiNPbkqIJWx32:t0Q+lAlxqd1wMuVdeJh0jLIg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
06f925683872be032e6fe721840cd048_JaffaCakes118

Files

06f925683872be032e6fe721840cd048_JaffaCakes118
.exe windows:4 windows x86 arch:x86

03a8717af4afb0642e4b515f6381de77

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapCreate
LocalSize
GetLastError
Sleep
VirtualAlloc
GetProcAddress
SetEvent
GetModuleHandleA
GetCurrentThreadId

user32

IsZoomed
IsWindowVisible
EnumThreadWindows
GetClientRect

gdi32

PatBlt

ole32

CoInitialize

netapi32

NetDfsManagerInitialize

avifil32

AVISaveOptions
AVISaveOptionsFree

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 702B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 209KB - Virtual size: 561KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ