4171c8b17d06a2ffef8c6fff4d9bbd52_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4171c8b17d06a2ffef8c6fff4d9bbd52_JaffaCakes118
Size

312KB
MD5

4171c8b17d06a2ffef8c6fff4d9bbd52
SHA1

803024d3a54c4241be5ccd01cdb418493b754dff
SHA256

1fe338e0611217bebeb534351d14a35ea141becf66e42cf87f9d1d5342030d48
SHA512

7d2444ffb761e1ada8bd4b73634ff5bc1484136da6e49272c49bb5cbc95a8e657ab249e556d85d423c349762050f42bf73c42b8958c80328c02ef0ae743aff47
SSDEEP

6144:A3iOiqCmf7X9BSYxKZaqVPr02IWN+vDRzqpIZx6OOwcNOraM6cK:A3iOvCmfjzSYxKo36N+vDRzqbTNOraM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4171c8b17d06a2ffef8c6fff4d9bbd52_JaffaCakes118

Files

4171c8b17d06a2ffef8c6fff4d9bbd52_JaffaCakes118
.exe windows:4 windows x86 arch:x86

77606ef7835c19febba81c8ec24a42e1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
VirtualFreeEx
ExitProcess
Sleep
HeapFree
TerminateThread
GetCurrentThreadId
VirtualAlloc
GetProcAddress
HeapAlloc
HeapReAlloc
RtlUnwind
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
LoadLibraryA

user32

RegisterClassA
IsWindowUnicode

advapi32

CryptAcquireContextA
CryptGenKey

shell32

DuplicateIcon

ole32

CoUninitialize

avifil32

AVISaveOptionsFree

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 236KB - Virtual size: 654KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ