29d997fd83a7f7182ab2faed5f3b6473_JaffaCakes118 | Triage

Sharing

General

Target

29d997fd83a7f7182ab2faed5f3b6473_JaffaCakes118
Size

344KB
MD5

29d997fd83a7f7182ab2faed5f3b6473
SHA1

03a10df596c6d3402254cbc273b19f5f5ea15785
SHA256

c1ab71121fb0a362f9320c03c0fb7f01fbbcde089cffbc977b4cfe83704f3883
SHA512

ca2c0b1780a9a40a195188850e3c87361036df5eb469fe475b6852bfb240d5c4fd4af307144658af020f2fbcbd2ee25dfe2a23a90f5ae2ad354e0df14457c7c8
SSDEEP

6144:2WqWqMY2pwQQuBUNJqAe6V+H5liEStrw1l/wTLTCo1AlgPKxd:cXWwiFA74ZlrYrw1lQTCO4gC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29d997fd83a7f7182ab2faed5f3b6473_JaffaCakes118

Files

29d997fd83a7f7182ab2faed5f3b6473_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b5cb147a043775fa995dbb94670cd866

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLocalTime
GetLastError
GetModuleHandleA
VirtualProtectEx
GetTempPathA
GetProcAddress

advapi32

ConvertSidToStringSidW

avifil32

CreateEditableStream

winmm

midiInClose

Sections

.text
Size: 88KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 188KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 500KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ