a5095119a5ca2a6c6b5e8f38022f9a39_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a5095119a5ca2a6c6b5e8f38022f9a39_JaffaCakes118
Size

348KB
MD5

a5095119a5ca2a6c6b5e8f38022f9a39
SHA1

fc86f5770e96bd6809c4856f08d393c9780c736b
SHA256

10d4d8c9de8955ab20f8a6b387300a6a8fffd7034d193bd5d639583aef86ca64
SHA512

fcaf54bcdf29fc25367fa70f8bacbe6e8f7394f204202fddd80bfcc1fb960bf00dc47d56384fc2e4e8f1acc6cd7d6622a1867476f56fd6e3f3cc6234e4ac3e8f
SSDEEP

6144:hOueI9QIywndJ7vLb8gg0hrBwxSAy5YZxLUOYBVpcAkd8lEAJpmqn:hDF8wndJ7lg0h1oBLXGxYYEAJpPn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a5095119a5ca2a6c6b5e8f38022f9a39_JaffaCakes118

Files

a5095119a5ca2a6c6b5e8f38022f9a39_JaffaCakes118
.exe windows:4 windows x86 arch:x86

30ea6d1660dd8e18216a932938a00d40

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
Sleep
GetLastError
ResumeThread
GetModuleHandleA
TerminateThread
GetProcAddress
VirtualAlloc
ExitProcess

user32

SendMessageA

advapi32

CryptAcquireContextA
CryptGenKey

ole32

CoUninitialize

psapi

GetWsChanges

avifil32

AVIStreamBeginStreaming
AVIBuildFilterA

msvfw32

DrawDibRealize

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 312KB - Virtual size: 309KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 458KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dbg
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ