737fb50b8262f1fd3dad125a1943763a_JaffaCakes118 | Triage

Sharing

General

Target

737fb50b8262f1fd3dad125a1943763a_JaffaCakes118
Size

340KB
MD5

737fb50b8262f1fd3dad125a1943763a
SHA1

71b729e88ba0c5d6ea237832040473697ecae5b4
SHA256

735f3a1e046c414d11ab276fba00b57b572d25eea60d9f7bd79af4490f2cb971
SHA512

800c672bb40dc293398210e988855015cfbf8145b6afc7ea0107a7428089025d58a1f9391fb25b66b1e60e1c09efe28c91aa6e55fa6c80b4df55669ed8e7470c
SSDEEP

6144:pOYXUi9M4clGvSlvHn3ycOi4k2B4WPQrE2y31ckWXkvY6C15gV49t8Dp3x0Ew+g3:pOYN9mP1H3ycpEB4WPuJyFc5XCY6C7gg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
737fb50b8262f1fd3dad125a1943763a_JaffaCakes118

Files

737fb50b8262f1fd3dad125a1943763a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d84aa3056e5711ee6b542ce39eb7c59a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
ExitProcess
GetCurrentThreadId
ResumeThread
GetCommandLineA
VirtualFree
VirtualLock
VirtualAlloc
OpenSemaphoreA
GetProcAddress
GetModuleHandleA
Sleep
TlsGetValue

user32

InSendMessage
UpdateWindow
LoadCursorA

advapi32

CryptAcquireContextA
CryptGenKey

ole32

CoUninitialize

avifil32

AVIBuildFilterA
AVIStreamBeginStreaming

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 746B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 124KB - Virtual size: 771KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 204KB - Virtual size: 202KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ