44bc540ed22c83517ff5068ba58da383_JaffaCakes118 | Triage

Sharing

General

Target

44bc540ed22c83517ff5068ba58da383_JaffaCakes118
Size

5.0MB
MD5

44bc540ed22c83517ff5068ba58da383
SHA1

f8c0d90a190912a004d540dc069fa39903b28c46
SHA256

529dad9429b7d3a12dec140fc790d7fe842c6b8cf4cdc3330deec6b94e050609
SHA512

8b61837e2d95b3b80500c530b00a11b32822b683dad71ab6e6ca65f679305113f5022e7b64892a6a6f36340abfe8f06607983315592cbf597b95f02aa63e853a
SSDEEP

49152:RnsQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:1/qPoBhz1aRxcSUDk36SA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
44bc540ed22c83517ff5068ba58da383_JaffaCakes118

Files

44bc540ed22c83517ff5068ba58da383_JaffaCakes118
.dll windows:4 windows x86 arch:x86

2e5708ae5fed0403e8117c645fb23e5b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
WriteFile
CreateFileA
SizeofResource
LockResource
LoadResource
FindResourceA
CreateProcessA

msvcrt

free
_initterm
malloc
_adjust_fdiv
sprintf

Exports

Exports

PlayGame

Sections

.text
Size: 4KB - Virtual size: 652B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 340B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.0MB - Virtual size: 5.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 684B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ