146aef2aed2522058186af526427ad5e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

146aef2aed2522058186af526427ad5e_JaffaCakes118
Size

316KB
MD5

146aef2aed2522058186af526427ad5e
SHA1

104852d0093faefdc35c0ecebfe9fd467a087a97
SHA256

793fbb04badb5113f99479d1894c3797cb33e0a35df3379e8ec3155c7c19b8db
SHA512

10d24395abc77ea2923df469c2c01330f8bfd15af1cbfdc4afdbde5cabc92a4327b7373f48549b1474540a631c72cec99fbb8af24bfcf043de14e28a675af6f0
SSDEEP

6144:/SMEdZDOTk82bDZcMRp4kImZTgbml51N2KmxPqq6dAeB6QdDfyvJNdc:/SpgsDppImVgbKLN2KQqq6dAeBnDfyhk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
146aef2aed2522058186af526427ad5e_JaffaCakes118

Files

146aef2aed2522058186af526427ad5e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d767eef85ae9089e3ac1ca75c70a2855

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
VirtualFreeEx
ExitProcess
Sleep
ResumeThread
VirtualAlloc
VirtualQuery
GetModuleHandleA
HeapFree
GetProcAddress
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
LoadLibraryA
RtlUnwind
HeapReAlloc
HeapAlloc

user32

PostQuitMessage

advapi32

CryptAcquireContextA
CryptExportKey

ole32

CoUninitialize

avifil32

AVISaveOptionsFree

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 236KB - Virtual size: 234KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 418KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ