cf6aab53bbf61f79fb8099effae59cf8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cf6aab53bbf61f79fb8099effae59cf8_JaffaCakes118
Size

368KB
MD5

cf6aab53bbf61f79fb8099effae59cf8
SHA1

dcf3fadddb1b92bbe9acfbad7bce9f4aa4fba11c
SHA256

74adb7abb2f90ffe400c0badc873ba1f81be9247da77a9e1eebe61cd03737319
SHA512

41110b59fc79880c9e3b111640b6fb4b9c21629ce84677d2b41a67929757dbbc23728b340b073d5ddfd8d4e40bb6939aa388edcd7aab252e6518374c4ae8184f
SSDEEP

6144:9BMqaXNTfA8LdO4kCoy0UqmFsjksrgg0cd3d0aD5sIlV:PZaXNTfA8Lfkb6YjkscdcRd0qWm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf6aab53bbf61f79fb8099effae59cf8_JaffaCakes118

Files

cf6aab53bbf61f79fb8099effae59cf8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e6ddeb6068f791b5b93adbe3e578f471

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemDirectoryA
GetSystemTime
VirtualProtect
OpenSemaphoreA
ExitProcess
GetLastError
GetModuleHandleA
GetProcAddress
PulseEvent
DeleteTimerQueue
FileTimeToSystemTime
LocalSize

user32

MoveWindow
InSendMessage
LoadAcceleratorsA
ShowWindow
SendMessageA
GetClientRect
DestroyWindow

gdi32

CreateHatchBrush
GetBitmapBits

advapi32

CopySid
AddAce

ole32

CoUninitialize

psapi

GetProcessMemoryInfo
GetModuleInformation

avifil32

EditStreamSetNameA

msvfw32

DrawDibStart

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 316KB - Virtual size: 653KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ