3208e737ab0853b94b69b0c8a547e84e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3208e737ab0853b94b69b0c8a547e84e_JaffaCakes118
Size

360KB
MD5

3208e737ab0853b94b69b0c8a547e84e
SHA1

ee02a9455ff9dc9b0decc5cf8459837cc234de92
SHA256

54d887047ea1e5915eb6966ea0201ecb5b517c631c42d38aeb86c405b464c8ae
SHA512

2fdc67463a645c7537b62cacf9ca752bccd977e79ec378866b88a37546fe46a2c00859efc4adf0c2480aa4f39f8e53cdd783833fd4d83184c189be6a061afd0b
SSDEEP

6144:08E9NP2/jYoG/lcHeNuV6iNAlnqUrslIKj0rfNgta7:MKjYBcHauVbmlnq+slT0rf6G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3208e737ab0853b94b69b0c8a547e84e_JaffaCakes118

Files

3208e737ab0853b94b69b0c8a547e84e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2af979d6a1625f953490fa44aa6c00c4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetLastError
HeapCompact
ExitProcess
FindNextFileA
GetProcessHeap
SetEvent
VirtualAlloc
GetSystemTime
OpenMutexA
HeapReAlloc
SetFileApisToANSI
VirtualProtect
GetModuleFileNameA
GetProcAddress
SuspendThread
GetCurrentProcess
GetSystemDirectoryA
HeapFree

user32

GetTopWindow
GetWindow
IsChild
FindWindowA
IsWindowUnicode
LoadIconA

advapi32

CopySid
AddAce

ole32

CoUninitialize

avifil32

EditStreamSetNameA

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 916B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 308KB - Virtual size: 653KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ