38103974b01ca9a9ccb2b2aadedee83d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

38103974b01ca9a9ccb2b2aadedee83d_JaffaCakes118
Size

316KB
MD5

38103974b01ca9a9ccb2b2aadedee83d
SHA1

a1dab989f6dba1e6a8ad3e2734e38fb230849f92
SHA256

5545885104361a886bc2f063e4feebf77978f1e2ca643eab4d2d1e5c3dfcc680
SHA512

02b7a7d4c0856a9c2555ed118526bc410b4659a0d72d5d83a90ce712f48e6fcd3f2f81d04f53b675571246907b9995a5da951b805410c1fd4f2d1961172c8765
SSDEEP

6144:1Wrjee61ZPGDWl8vpETlrPIJEn1L5FJY/cetV0PFR:1WrjDqvgpiPIJC1L6/cetV03

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
38103974b01ca9a9ccb2b2aadedee83d_JaffaCakes118

Files

38103974b01ca9a9ccb2b2aadedee83d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fd145841c8d854c9cce1c426d7019bd6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateThread
GetLastError
VirtualFreeEx
ExitProcess
Sleep
VirtualAlloc
GetModuleHandleA
GetProcAddress
GetCurrentThread
HeapFree
GetCommandLineA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
LoadLibraryA
RtlUnwind
HeapReAlloc
HeapAlloc

user32

LoadIconA
IsIconic

advapi32

CryptAcquireContextA
CryptGenKey

ole32

CoUninitialize

avifil32

AVISaveOptionsFree

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 236KB - Virtual size: 738KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ