949e80e048a1b1a0dc1b91faab8cbcd9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

949e80e048a1b1a0dc1b91faab8cbcd9_JaffaCakes118
Size

404KB
MD5

949e80e048a1b1a0dc1b91faab8cbcd9
SHA1

7e3cbe205b7b82fa15c91f9d0c86ae0658c843c6
SHA256

9f2ab95e331f81c9d40b31f4902bda711a7ebba50bf910d4b6831b0d48df697f
SHA512

99b1068bb225ca1648e81f5e16d12284bb2f0076dd8133e5e88d0b70464e82cd5180c4d404d758ced609345c09b3378fff8aac9c02623a95033f8acdcd87f8a7
SSDEEP

12288:B8OkKO80EtBpUIeJJAoAqlw1oa6SUGOzcoha:B8OiEZXewqSsJJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
949e80e048a1b1a0dc1b91faab8cbcd9_JaffaCakes118

Files

949e80e048a1b1a0dc1b91faab8cbcd9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1c706c6f67b7d173b6ab503ee04d3cd1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateThread
GetLastError
CloseHandle
GetModuleHandleA
GetFileSize
CreateFileA
Sleep
GetProcAddress
VirtualFree
VirtualAlloc

netapi32

NetDfsRemoveFtRoot

avifil32

AVISaveOptions
AVISaveOptionsFree

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 464B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 92KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 300KB - Virtual size: 699KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ