44084d548ad12c3eaa833288fef0bbb0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

44084d548ad12c3eaa833288fef0bbb0_JaffaCakes118
Size

359KB
MD5

44084d548ad12c3eaa833288fef0bbb0
SHA1

34ac6c8cc4e731a047bcffcff9a902b5a4c01422
SHA256

68e013e8cff6823babf4ac17ab6e26ed4cf764eb392eb88d59e7ae10a7b26988
SHA512

9d2c209f7bf4434a4f3b191914aa90652ae5d61af2d361d3d039916d569dc473371be07cab017373bcee2bc726a56a64bbe413c1174f92230fe0b3e89e7933b3
SSDEEP

6144:KbOGhgyv6xseuiT+VwzzK2h1obhOZkHBmWRnsRE3tzQVR1MtDiVJrcOczu:KbOG2seuQawzzJh1obhRBNskMDSDiL0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44084d548ad12c3eaa833288fef0bbb0_JaffaCakes118

Files

44084d548ad12c3eaa833288fef0bbb0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a9ce7e2ed2347714189398e68745ae26

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
Sleep
SearchPathA
CreateThread
FindAtomA
VirtualProtect
FindVolumeClose
GetCalendarInfoA
TlsGetValue
ReleaseMutex
GetModuleHandleA
CloseHandle
FindClose
GetDiskFreeSpaceA
SetEvent
FindResourceExA
GetLastError
ExitProcess
DeleteCriticalSection
lstrlenA

advapi32

LsaClose
OpenEventLogA
RegCloseKey
RegLoadKeyA
GetFileSecurityA
CloseEventLog
LsaFreeMemory
RegCreateKeyExA
AccessCheck
LsaSetSecret
RegEnumKeyExA
IsValidSid
CloseTrace
FreeSid
RegCloseKey

msdmo

DMOEnum
DMOUnregister
DMOGetTypes
DMOGetName
DMORegister

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 522B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ