44489fec813b40d639e2cad5620b0f79_JaffaCakes118 | Triage

Sharing

General

Target

44489fec813b40d639e2cad5620b0f79_JaffaCakes118
Size

25KB
MD5

44489fec813b40d639e2cad5620b0f79
SHA1

94540ac0bdb3c08a156ca83da2cd32f08686edc4
SHA256

c4cbf0bbc828224527ebe0d5b26e9599c0994c01bfc5ffb33f376b63ec4e669a
SHA512

779dce9326ba4448826d20142acbacd4d1d43170b400b7d88caacee9ddb55a6a5a5519a8b4f7542cfdef6755174d1f810b871d77d9eff6bb1126d5178cbd0462
SSDEEP

384:+uBACJEQiyhqgepVMtydIeyHiX/FFjduJXyVMvpo4XHCyZ/yqtPMRzQe2ibG:jAm1hJ0VMsdIviX/bjd0Jpo4XhjTebG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44489fec813b40d639e2cad5620b0f79_JaffaCakes118

Files

44489fec813b40d639e2cad5620b0f79_JaffaCakes118
.exe windows:1 windows x86 arch:x86

e2c69898e19633e9830253504d1e2896

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

ElfDeregisterEventSource
CryptGetKeyParam
FindFirstFreeAce
GetSecurityDescriptorDacl
GetTokenInformation

kernel32

ClearCommBreak
ConvertThreadToFiber
CreateEventA
CreateMutexA
DefineDosDeviceA

Sections

.text
Size: 17KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE