3179405b607eaa10ec0addd22dc43fb2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3179405b607eaa10ec0addd22dc43fb2_JaffaCakes118
Size

384KB
MD5

3179405b607eaa10ec0addd22dc43fb2
SHA1

127026d72a150cc621dd83a8cac7ad20ffe96c40
SHA256

69c8917dd1752c82f4c91169d02a4d7c3ccb1e82559c80f76d435aa3b8439f6f
SHA512

803d1ba0adebbd45580e94677668fd52a12c1fa8adb71d575f0b73d49e263ce70e1b43c6b29e023ab1cfbf3b64079505e5dc96230d98433e3aa6a3a3ff039ab1
SSDEEP

6144:IqS3csGWy0thTey8sFFjqHtM7t4vMY0E6soP5P2N9wBn/NDzWxYU83MqP:Mc7WyGh37FxHyvMzVd2N9on/NGNmMq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3179405b607eaa10ec0addd22dc43fb2_JaffaCakes118

Files

3179405b607eaa10ec0addd22dc43fb2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

58d169c568ec509cdabc84798251dfb7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileType
GetCurrentProcessId
GetSystemDirectoryA
GetSystemTime
GetCurrentProcess
ResetEvent
VirtualFreeEx
GetCommandLineA
HeapFree
ExitProcess
FindNextFileA
GetLastError
GetModuleHandleA
FindClose
VirtualQuery
GetProcAddress
VirtualLock
GetProcessHeap

user32

GetDesktopWindow
ShowWindow
GetLastActivePopup
LoadAcceleratorsA

gdi32

CreateDIBPatternBrush
GetPixel
CreateHatchBrush
PatBlt

advapi32

CopySid
AddAce

shell32

SHGetFolderPathA

ole32

CoUninitialize

avifil32

AVIStreamCreate

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 344KB - Virtual size: 759KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ