44baf71c2210174d6a9de973f5f02c9f_JaffaCakes118

General

Target
44baf71c2210174d6a9de973f5f02c9f_JaffaCakes118
Size 1.1MB
Sample240330-1d3n4sff94
SHA256 e12472ea051ad0b73a8166ca2cb539168f89bfb1e12130a916df605a88423b31
MD5 44baf71c2210174d6a9de973f5f02c9f
SHA1 6e10f407dc8faa4879bf2ab0f28fbeeada5d4033
SHA512 4d7cbf50c7e4fa02a3bad37b30ca91788798caeb5f16f83bea2a917cdbfcf9e0009020a1e1af6c1af2e913d85739dc4111dcb2b128efe08272fc8193e5d16adc
SSDEEP 24576:/bxjt/UTmNUew84fUfA+yo8T/6L0REVLCiH062cchSZH8f:7BN3FyYZCijIm6
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44baf71c2210174d6a9de973f5f02c9f_JaffaCakes118

File Explorer

44baf71c2210174d6a9de973f5f02c9f_JaffaCakes118

.exe 1.1MB

44baf71c2210174d6a9de973f5f02c9f_JaffaCakes118

IMPHASH c8c17e47eb07afabbfe8e635fca5ad02
SHA256 e12472ea051ad0b73a8166ca2cb539168f89bfb1e12130a916df605a88423b31
MD5 44baf71c2210174d6a9de973f5f02c9f
SHA1 6e10f407dc8faa4879bf2ab0f28fbeeada5d4033
SHA512 4d7cbf50c7e4fa02a3bad37b30ca91788798caeb5f16f83bea2a917cdbfcf9e0009020a1e1af6c1af2e913d85739dc4111dcb2b128efe08272fc8193e5d16adc
SSDEEP 24576:/bxjt/UTmNUew84fUfA+yo8T/6L0REVLCiH062cchSZH8f:7BN3FyYZCijIm6
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

6601

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\todufuce-wumobewa\leg\tagohabobe\44.pdb

kernel32

HeapReAlloc UnmapViewOfFile EndUpdateResourceW ReadConsoleA GetCurrentProcess BackupSeek FindActCtxSectionStringA GetEnvironmentStrings GlobalAlloc Sleep InitAtomTable HeapDestroy FindNextVolumeW WriteConsoleW GetModuleFileNameW CreateActCtxA GetACP ReleaseSemaphore SetTapePosition SetLastError GetProcAddress BeginUpdateResourceW ResetEvent DebugSetProcessKillOnExit CreateIoCompletionPort GetModuleHandleA GetProcessShutdownParameters VirtualProtect GetCurrentProcessId FindNextVolumeA LCMapStringW lstrcpyA GetCommandLineW HeapSetInformation GetStartupInfoW HeapAlloc EnterCriticalSection LeaveCriticalSection DecodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetLastError HeapFree SetFilePointer CloseHandle GetModuleHandleW ExitProcess WriteFile GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetCPInfo GetOEMCP IsValidCodePage WideCharToMultiByte RtlUnwind SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers LoadLibraryW RaiseException MultiByteToWideChar GetStringTypeW IsProcessorFeaturePresent HeapSize CreateFileW

Name

.text

Size

999KB

Virtual Size

999KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.koyarul

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.sud

Size

512B

Virtual Size

23B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

44baf71c2210174d6a9de973f5f02c9f_JaffaCakes118

kernel32

generic