17d893805cf8495909634356892bd15a_JaffaCakes118 | Triage

Sharing

General

Target

17d893805cf8495909634356892bd15a_JaffaCakes118
Size

448KB
MD5

17d893805cf8495909634356892bd15a
SHA1

790712bb8ed13524e7a979d02326d5da6e2dc623
SHA256

c12f445acdfc2e6ae8b4095e79d97fdd362f2804a37c125cf68fb056225c0caf
SHA512

d045751617be434aeedd6448d920f8bcb35395aa2f93ef793ec34c265279e307c35b10cc2a8da0d0a01efc3b367c709e42e46e69b0bcf27c8a04fa53ac177075
SSDEEP

6144:vUMcTcbOLkF8lYXJTIUEhRfPjC2oqwhRnlA67ffpW+V/tQC6TK7:vZcTcsC8lYXNOm9n7ffpWRCN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17d893805cf8495909634356892bd15a_JaffaCakes118

Files

17d893805cf8495909634356892bd15a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1c6ed2509f1cca5f4bacf18525e54dd1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetLastError
GlobalLock
ExitProcess
GetSystemDirectoryA
GetSystemTime
GetProcAddress
GetFileType
ResumeThread
VirtualFreeEx
Sleep
GetProcessHeap
GetTempPathA
VirtualLock
SetEvent
LeaveCriticalSection
VirtualQuery

user32

DestroyWindow
GetTopWindow
UpdateWindow
GetSysColorBrush
LoadAcceleratorsA
IsZoomed

advapi32

CopySid
AddAce

ole32

CoUninitialize

psapi

EnumProcessModules

msvfw32

DrawDibDraw

avifil32

AVIStreamCreate

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 300KB - Virtual size: 296KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 8KB - Virtual size: 490KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 124KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ