44e8bfbea7d9abecd3b44c722bcb8bd5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

44e8bfbea7d9abecd3b44c722bcb8bd5_JaffaCakes118
Size

221KB
MD5

44e8bfbea7d9abecd3b44c722bcb8bd5
SHA1

77abc50ce79e725b8f6c714e9776473ab3f2f8f9
SHA256

78e032aa9b553cd0aecb899807dc364f9e16ca3bc6af802f565cf8df8811139d
SHA512

6e81d0e022c7c61f7be97c1f5a37197af0521b520b89d5c6c7720d47463afc7ba9ca6c80a097eb14b588d038f82e9b0acd2206ab051fc87f09f0b4ddba3d370c
SSDEEP

6144:efGJvnZH3rSsNAfh4uMK1Dya5L8QLayv8J6My05N9D:egnZH3rzNu+FdYAN9D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44e8bfbea7d9abecd3b44c722bcb8bd5_JaffaCakes118

Files

44e8bfbea7d9abecd3b44c722bcb8bd5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f8aafc6d78a9d96ee4953053fc1e0af7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
GetCurrentProcess
LoadLibraryA
CloseHandle
CreateFileA
LCMapStringA
ExitProcess

user32

wsprintfA
CreateWindowExA
SetWindowLongA
CloseWindow
CharLowerBuffA

advapi32

RegCloseKey
RegQueryValueA
RegDeleteKeyA
RegEnumKeyA
RegEnumValueA
RegSetValueA
RegCreateKeyA
RegOpenKeyA
RegDeleteValueA

Sections

.text
Size: 160KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ