a5053c42a4b9b5d0c274806a622babe3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a5053c42a4b9b5d0c274806a622babe3_JaffaCakes118
Size

316KB
MD5

a5053c42a4b9b5d0c274806a622babe3
SHA1

d68e6f2fe368348d51e2bef919a2b7eb718bb2b9
SHA256

4ffa15cf8e913b255caff45aca720ea15d1ca1d494bd08aa8fd25f2486e5fc3c
SHA512

32fd9492b9a790c2e4a4e1f935317490703fa873f67d66e98623698514f068fb5c4b13d44c27b59debbfa995015d97d8b2e8cf4853bba5734bcbf2b2611adfb6
SSDEEP

6144:S4WsYqqMpnO+6xfKLIqCtPTmZEtuuzrj+xl+1OP+kYQ2isxufhIU:S4PYUcxSLIhPyZEtuuzf+HwLQ7ZIU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a5053c42a4b9b5d0c274806a622babe3_JaffaCakes118

Files

a5053c42a4b9b5d0c274806a622babe3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fd145841c8d854c9cce1c426d7019bd6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateThread
GetLastError
VirtualFreeEx
ExitProcess
Sleep
VirtualAlloc
GetModuleHandleA
GetProcAddress
GetCurrentThread
HeapFree
GetCommandLineA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
LoadLibraryA
RtlUnwind
HeapReAlloc
HeapAlloc

user32

LoadIconA
IsIconic

advapi32

CryptAcquireContextA
CryptGenKey

ole32

CoUninitialize

avifil32

AVISaveOptionsFree

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 236KB - Virtual size: 738KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ