22abd510f50ddcdd62c9dab53c980e25_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

22abd510f50ddcdd62c9dab53c980e25_JaffaCakes118
Size

316KB
MD5

22abd510f50ddcdd62c9dab53c980e25
SHA1

3c8d1bf33b6c7d37c0fb41fccd2378909f1541bd
SHA256

12e89314825f3cdd44207aae0cbc635519709423148280def0171329d5c0da36
SHA512

c78665c725d7d56128929180fdab81645a816c3192ae32bfa1205a5944ba883e897a694da5094686b7fd5b8f6841c3ad42db8f0c29769bfdd4d52836882ff52c
SSDEEP

6144:g2DonsG5EdYezv7+DHhG/11zu8hxwLB7vhbrvPj:g2D1CbjHhQZu87SB7vhbrX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
22abd510f50ddcdd62c9dab53c980e25_JaffaCakes118

Files

22abd510f50ddcdd62c9dab53c980e25_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fd145841c8d854c9cce1c426d7019bd6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateThread
GetLastError
VirtualFreeEx
ExitProcess
Sleep
VirtualAlloc
GetModuleHandleA
GetProcAddress
GetCurrentThread
HeapFree
GetCommandLineA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
LoadLibraryA
RtlUnwind
HeapReAlloc
HeapAlloc

user32

LoadIconA
IsIconic

advapi32

CryptAcquireContextA
CryptGenKey

ole32

CoUninitialize

avifil32

AVISaveOptionsFree

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 236KB - Virtual size: 738KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ