36083e145fb5a090a33a83bf533b5594_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

36083e145fb5a090a33a83bf533b5594_JaffaCakes118
Size

348KB
MD5

36083e145fb5a090a33a83bf533b5594
SHA1

bf76cc35315323a6c498f324eb6b8812e519a220
SHA256

405a8042e3ec729b3d16c3465cba104a00ff0cdc36582fcf96fae68df63a9202
SHA512

9ddceffd1afb77af502176b78193b88c3bd025920051263acf6639e124fefb5459d52ab243da325bd036c1bc9704922a6c107a25014767c86faf3029cf365d0f
SSDEEP

6144:I+0o3OSeDF0yx/Z0F0r1cTCBw3K3YaDhvZ+ZTLMqBHN8iLt9TelFdXG:IJXSwhZwfCBEKDB+dMqBHN8iLilFdXG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36083e145fb5a090a33a83bf533b5594_JaffaCakes118

Files

36083e145fb5a090a33a83bf533b5594_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e54e99b02c38bff0879cfd75a5276944

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
ExitProcess
Sleep
GetCommandLineA
ResumeThread
VirtualLock
CloseHandle
UnmapViewOfFile
GetProcAddress
GetModuleHandleA
GetTempPathA
VirtualAlloc

user32

wsprintfA

advapi32

CryptAcquireContextA

ole32

CoUninitialize

msvfw32

DrawDibTime

crypt32

CertCloseStore

winmm

midiInClose

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: 188KB - Virtual size: 555KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ