44922f6d7e752463aa2933dd2f8216c6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

44922f6d7e752463aa2933dd2f8216c6_JaffaCakes118
Size

144KB
MD5

44922f6d7e752463aa2933dd2f8216c6
SHA1

8478ecea136036fa07714ea3d360e7cdac847b48
SHA256

c71867fd256e1febab680dc9b37c1c7ca5d3f7b1e2bb385fffac834093877faf
SHA512

73d14dcbd698e1e8fa8f0d954b28da76f00420b5c323abc30c9c28daf9e79c40895370685f518a827b06d161951439cc1f0dde36dfaa1483658a8ce12f1c1148
SSDEEP

3072:E4DF08PWNzbV/ZmbWVUA7Vz0e5n5uxz/cZXlmk3rlI/dJy3VFv:50rvV4GtJt8TcpoYr+qVZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44922f6d7e752463aa2933dd2f8216c6_JaffaCakes118

Files

44922f6d7e752463aa2933dd2f8216c6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

CODE
Size: 138KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ShenLan
Size: 44B - Virtual size: 44B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE