ee686d188951d86882f11841f32978d4_JaffaCakes118 | Triage

Sharing

General

Target

ee686d188951d86882f11841f32978d4_JaffaCakes118
Size

360KB
MD5

ee686d188951d86882f11841f32978d4
SHA1

941d5ef67a478929d9e91689e90b00d587c068cf
SHA256

2b2c3d8011e5c7549c40c6abf5408b3b442c4f23b1b4980af5fa6e4954336d0f
SHA512

4c7a35dd495523e2d2f035f0c58c8ec4ea5be2eab76b54bcdc26d501fa7c8925e5169c6096c056a95f5c86ec34be0f3c8bb862a410d5c34baf6c3c8522c21fce
SSDEEP

6144:5gVHy4A1P2VtDBaSbKIN6VNAkVPxrXBEsyC4MgJkEfevZut:+ly4AStDwCVNWNA8PtXBzjxa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ee686d188951d86882f11841f32978d4_JaffaCakes118

Files

ee686d188951d86882f11841f32978d4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c54db1b1b3f3959b121b10a5259deaeb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
ExitProcess
VirtualQuery
Sleep
GetCommandLineA
ResumeThread
OpenSemaphoreA
VirtualLock
CloseHandle
UnmapViewOfFile
VirtualAlloc
GetModuleHandleA
GetTempPathA
GetProcAddress

user32

wsprintfA
IsChild

advapi32

CryptAcquireContextA

ole32

CoUninitialize

msvfw32

DrawDibTime

crypt32

CertCloseStore

winmm

midiInClose

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: 188KB - Virtual size: 667KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ