247a42a457ff376ef3ab51c65cb06cd1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

247a42a457ff376ef3ab51c65cb06cd1_JaffaCakes118
Size

380KB
MD5

247a42a457ff376ef3ab51c65cb06cd1
SHA1

98262ac6404f6c3e9a550f40a39924a9dfe8f492
SHA256

1002bc9bbb5d9fec0e1cb2fef585a5ff5c6ad56f7cfef0491ef2c7fceeae1c89
SHA512

c9f68b52ff4f2420e8d44ee56e78bd1a102a43e92fa63635be4c580f86648aa9ad2d745fe4ec4b23cd8bcb7d8ea9d3d175717e2321e64cfd8c77d4d8c0158f3f
SSDEEP

6144:Khv7nIL5bkQBI81n5uhIKjeYirxN7GfT7KcKff1+aTY0:ivE5bkS5uuYY3Gf3Kh+yY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
247a42a457ff376ef3ab51c65cb06cd1_JaffaCakes118

Files

247a42a457ff376ef3ab51c65cb06cd1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a32e56691e25b0062d3ad56a649cb7a1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
ExitProcess
DeleteTimerQueue
GetSystemTime
VirtualProtect
Sleep
GlobalLock
LocalReAlloc
GetModuleHandleA
CloseHandle
GetProcAddress
FindClose
GetSystemDirectoryA
VirtualFreeEx
OpenEventA

user32

GetWindow
PostQuitMessage
SendMessageA
ShowWindow

gdi32

CreateDIBPatternBrushPt

advapi32

AddAce
CopySid

ole32

CoUninitialize

psapi

GetModuleInformation
GetModuleBaseNameA

avifil32

AVIStreamCreate

msvfw32

ICRemove

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 332KB - Virtual size: 330KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 8KB - Virtual size: 425KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ