711a30896073ee0b683c19a261d37399_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

711a30896073ee0b683c19a261d37399_JaffaCakes118
Size

364KB
MD5

711a30896073ee0b683c19a261d37399
SHA1

d761734791861b56d9b21b7da7321b14c9d21f1a
SHA256

aaee4a7bee47226da60bf37117020ed290e47e05e08720075e6595611f4174de
SHA512

e279b55c3540eb6e1d6cb8bbb1473b560499fadbe8d09e589f77183a70dad95d43847776797cc70c9dfa3129ee2f2b228fec0186ac4ddbd82d98b9a3cd3b0f3a
SSDEEP

6144:J8dQ1IPLWmLsD0EftWdh0CDqFOApQ8X0Fa3J1VrXH7B:eQ1IPKfqym6rX0U77B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
711a30896073ee0b683c19a261d37399_JaffaCakes118

Files

711a30896073ee0b683c19a261d37399_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b49c86defa4aab64fab705d1c47cf23c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
LocalLock
GetLastError
ExitProcess
GetSystemDirectoryA
GetProcAddress
GetPriorityClass
VirtualQuery
DeleteCriticalSection
VirtualFreeEx
PulseEvent
InitializeCriticalSection
ReleaseSemaphore
GetCommandLineA
GetProcessHeap
LocalSize
GetSystemTime
HeapCreate

user32

GetSysColorBrush

gdi32

GetPixel

advapi32

AddAce
CopySid

ole32

CoUninitialize

psapi

EnumProcessModules

avifil32

AVIStreamCreate

msvfw32

DrawDibOpen
ICInstall

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 308KB - Virtual size: 648KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ