44543327499133fbecf768969136e487_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

44543327499133fbecf768969136e487_JaffaCakes118
Size

361KB
MD5

44543327499133fbecf768969136e487
SHA1

78480cc9308a0d798cd346b56d8858ba985c2da5
SHA256

143d257ac5b30db9e5ab9ddbc7a18b1f604cff2ff4c7788b27ab5f9de9d5c48e
SHA512

867073ab656029849da25aba295f5a8697f93c23a2063f20aaa8f19bc3c6b4550aa4c3975d20604722d9109eac740253a120b513696f5a7cf15fc0459c9f3efd
SSDEEP

3072:VA8+K5KMf5DtQshKd+/rJcnIgRUXeQlTuLC0:O8DFf5Pc+DeJiesT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44543327499133fbecf768969136e487_JaffaCakes118

Files

44543327499133fbecf768969136e487_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2bed3b575b122ce7042753fe75b3b7d0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
FormatMessageA
GetLastError
SetLastError
VirtualAlloc
CloseHandle
MapViewOfFile
CreateFileMappingA
VirtualFree
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
GetModuleFileNameA
GetModuleFileNameW
SetEnvironmentVariableW
SetEnvironmentVariableA
WideCharToMultiByte
UnmapViewOfFile
lstrcpynW
GetFullPathNameW
GetFullPathNameA
HeapAlloc
GetProcessHeap
GetFileSize
ReadFile
SetFilePointer
CreateFileW
GetEnvironmentVariableW
CreateFileA
GetEnvironmentVariableA
GetVersion

user32

MessageBoxA

Sections

.text
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.res
Size: 354KB - Virtual size: 6.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE