44ab83c56b2d254e256a939ff1f99eac_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

44ab83c56b2d254e256a939ff1f99eac_JaffaCakes118
Size

167KB
MD5

44ab83c56b2d254e256a939ff1f99eac
SHA1

5a690f183228ffce6da5a96b69db0c43f39458a6
SHA256

67f083663911fe0196379e78f0e1e85a678e9e1068dafe1880d1855a8d1aae32
SHA512

d83b6e07073b7b304d839ec78d3c79efec4e811a0c335bca3aa67c03cb7e4e5203f5265f95c4113e3eec82afc747542722c72cc47de816319beb6ea151411efa
SSDEEP

3072:dEqvGckQXucJ2uzRbWpnMG9Y6C9A1zxYezrjBeaEhB7vJD4Ju:6BcDXucbzRbW1vMuDwaqh4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44ab83c56b2d254e256a939ff1f99eac_JaffaCakes118

Files

44ab83c56b2d254e256a939ff1f99eac_JaffaCakes118
.exe windows:5 windows x86 arch:x86

98cceeea5e5876da496d3a199fa01b5b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\KrowXGuhNAS\vHssRkIywvy\resWjcsZGRZpk\lishSQsmhdVtjT.pdb

Imports

shlwapi

StrCmpIW
ChrCmpIW
UrlGetLocationW

kernel32

CallNamedPipeW
GetCommandLineA
LoadLibraryA
SetThreadPriority
GetModuleHandleA
lstrlenA
GetModuleFileNameA
SetCurrentDirectoryA

msvcrt

_controlfp
strstr
strcspn
__set_app_type
atoi
__p__fmode
__p__commode
_amsg_exit
_initterm
_ismbblead
_wtoi
_XcptFilter
_exit
_cexit
__setusermatherr
rand
__getmainargs
memset

gdi32

SetBitmapBits
OffsetRgn
EndPage
GetTextMetricsW
ExtTextOutA
Polygon

user32

IsCharUpperW
GetIconInfo
DefFrameProcA
DrawStateA
GetMessagePos
GetWindowDC
SendInput
BeginDeferWindowPos
wsprintfW

Exports

Exports

?CreateDlgMessage@@YGHPAXPADK|U

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.ort
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 137KB - Virtual size: 393KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE