8a893b099cd2feedec8ceb51be38c42a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8a893b099cd2feedec8ceb51be38c42a_JaffaCakes118
Size

448KB
MD5

8a893b099cd2feedec8ceb51be38c42a
SHA1

39ac486fd919b55b731b9069a994418e7d9d5f55
SHA256

62325b3aa080fcea966c1d973aec2f659b4cc0cc0b2cc8ad2be8a14385859dad
SHA512

aa71d97bd37e076a625061861f5b7659c5b9196162a4922a37833c7387d8d3fe258b2eaa39af65870e70dc4804ec664f687387cff9c528329a11ad314c40e063
SSDEEP

6144:hyGPc9n++ws+tu39ACcNNEdUXZg9tVbbxevpBR+tpWdrD/W0deVxS01FFQnBqMOs:h29++db57t9bPovNKod+cuxS0bFQB3b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8a893b099cd2feedec8ceb51be38c42a_JaffaCakes118

Files

8a893b099cd2feedec8ceb51be38c42a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b49c86defa4aab64fab705d1c47cf23c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
LocalLock
GetLastError
ExitProcess
GetSystemDirectoryA
GetProcAddress
GetPriorityClass
VirtualQuery
DeleteCriticalSection
VirtualFreeEx
PulseEvent
InitializeCriticalSection
ReleaseSemaphore
GetCommandLineA
GetProcessHeap
LocalSize
GetSystemTime
HeapCreate

user32

GetSysColorBrush

gdi32

GetPixel

advapi32

AddAce
CopySid

ole32

CoUninitialize

psapi

EnumProcessModules

avifil32

AVIStreamCreate

msvfw32

DrawDibOpen
ICInstall

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 308KB - Virtual size: 784KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 120KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ