d6826810fa7eed0dea9f4ae0a60a72d4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d6826810fa7eed0dea9f4ae0a60a72d4_JaffaCakes118
Size

340KB
MD5

d6826810fa7eed0dea9f4ae0a60a72d4
SHA1

e9459bab1ab408dd0fa84b29e77d740bb78f5b65
SHA256

591f6d68685e87dbbadf0227cdd9da57b5be6f5470b5a6204222859cb0a6479b
SHA512

c2ef342a10691ceeb3e41121f489aaf27f0c458ced9b8706cccbb80a1166d1ed127e01d10ad2c5185dedd56e5a2ef6722f4e4b4dc3d5f29828df369d478c2a5f
SSDEEP

6144:+JUhPyofkfBjwyf6+uD6/ACLknmq6V8cwh90hBbxyKvcD:+JUJRgS5EIFtfh90hZx7v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d6826810fa7eed0dea9f4ae0a60a72d4_JaffaCakes118

Files

d6826810fa7eed0dea9f4ae0a60a72d4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d84aa3056e5711ee6b542ce39eb7c59a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
ExitProcess
GetCurrentThreadId
ResumeThread
GetCommandLineA
VirtualFree
VirtualLock
VirtualAlloc
OpenSemaphoreA
GetProcAddress
GetModuleHandleA
Sleep
TlsGetValue

user32

InSendMessage
UpdateWindow
LoadCursorA

advapi32

CryptAcquireContextA
CryptGenKey

ole32

CoUninitialize

avifil32

AVIBuildFilterA
AVIStreamBeginStreaming

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 746B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 124KB - Virtual size: 771KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 204KB - Virtual size: 202KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ