44d20d8e9699f603a049846b4db7a1a7_JaffaCakes118 | Triage

Sharing

General

Target

44d20d8e9699f603a049846b4db7a1a7_JaffaCakes118
Size

37KB
MD5

44d20d8e9699f603a049846b4db7a1a7
SHA1

df6cb0cbff7eb00f5a0ca7bf7ac8b689a994f5a9
SHA256

b9bb1da606f2991e8afa464fed84745babf47c297220ef0980e32b446dc424ba
SHA512

47b16f12a6b70bf3b939280d675b6c928f3d29b8f8c881a61c873807b620511159fcd4fd23671bea47161326ba6e0e3cb0517e92d37f5948c2f0bd56206ed59c
SSDEEP

768:ORUEClQ+ruTGTyO0JPhFjo1CNr3MXHSKMM46N9D1Aa:O5ClQ+qGTyOkPhFjC0jMedq9W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44d20d8e9699f603a049846b4db7a1a7_JaffaCakes118

Files

44d20d8e9699f603a049846b4db7a1a7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e45d5e8b6a7e85665298863746e19afa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
GetProcAddress
GetTempPathA
GetModuleHandleA
lstrcatA
GlobalAlloc
LoadLibraryExA
GlobalFree
FreeLibrary
CreateFileA
HeapAlloc
GetProcessHeap
DeviceIoControl
HeapFree
CloseHandle
lstrcpyA
CreatePipe
CreateProcessA
WaitForSingleObject
GetFileAttributesA
DeleteFileA
MoveFileA
CopyFileA
MoveFileExA
WriteFile
GetVersionExA

user32

wvsprintfA

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE