8e01853c3068f2576d2aadb184cb7b63_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8e01853c3068f2576d2aadb184cb7b63_JaffaCakes118
Size

376KB
MD5

8e01853c3068f2576d2aadb184cb7b63
SHA1

c6a9f1a42bd4827d0bc03b916f9d1efddab7340b
SHA256

f958a6d21df3be6172d814bbf86ed7b72cc8cebd66fb26b5e1e315e7b6a338fe
SHA512

06eb2d31c5d3bbfa105f657ea40909af761d901bcab381e3404db448b981b0b93e8bef29dfbe22dbe0d955d6c3cc9e493cd46de71ce2fa7637d84a698a5648ab
SSDEEP

6144:XlcLbE/T/SIa+T4MV1QB1Tq+PEpyHyKz59Fg0/3dBGiLXUjcZ:a3EbZ0K4TBEeyIZ/dlLXU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e01853c3068f2576d2aadb184cb7b63_JaffaCakes118

Files

8e01853c3068f2576d2aadb184cb7b63_JaffaCakes118
.exe windows:4 windows x86 arch:x86

00432b2d5354cfd2e08caa7929f4fb30

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetCurrentThread
GetSystemDirectoryA
GetSystemTime
ReleaseMutex
GetLastError
VirtualFreeEx
Sleep
FindClose
GetModuleHandleA
IsBadWritePtr
GetProcAddress
VirtualAlloc
HeapDestroy

user32

UpdateWindow
InSendMessage
IsWindowVisible
LoadIconA

advapi32

CopySid
AddAce

ole32

CoUninitialize

psapi

GetWsChanges

msvfw32

DrawDibSetPalette
DrawDibProfileDisplay
DrawDibDraw

avifil32

AVIStreamCreate

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 332KB - Virtual size: 331KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 8KB - Virtual size: 429KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ