a5205e9455f3c1fec087ceba701113c8_JaffaCakes118 | Triage

Sharing

General

Target

a5205e9455f3c1fec087ceba701113c8_JaffaCakes118
Size

316KB
MD5

a5205e9455f3c1fec087ceba701113c8
SHA1

2818ee1d93520f4d39e8e2a5ffa0f58563a068b7
SHA256

42a0ea0985da8469cb2dd531f3e1aaf1e2a77c3d785419409338712cdc9a5814
SHA512

e1b05b4a6e3f5c522ab0a35029add23a4c97ff21c1a09dc743a76dae59c9a0c9f92cf2e8dceb7478a6f84b81aa5f66c497ded8ef146d6036a48878a02b7f3d6c
SSDEEP

6144:Ktz8x1gu03SClVIHzTdgY0C6PK1xjNCz3WYyU6mGst7:Ktz8xiuFCr6zJbYKG3WYyUNb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a5205e9455f3c1fec087ceba701113c8_JaffaCakes118

Files

a5205e9455f3c1fec087ceba701113c8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ac72a77b565627485e5528deb5c45f4a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
CloseHandle
VirtualFreeEx
GetFileSize
CreateFileA
ExitProcess
Sleep
TerminateThread
HeapFree
GetProcAddress
GetModuleHandleA
VirtualAlloc
IsBadCodePtr
GetEnvironmentStrings
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
LoadLibraryA
RtlUnwind
HeapReAlloc
HeapAlloc

user32

FindWindowA
LoadIconA
ShowWindow

advapi32

CryptAcquireContextA
CryptGenKey

ole32

CoUninitialize

avifil32

AVISaveOptionsFree

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 236KB - Virtual size: 650KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ