44060c7bc5fc98cf30695ce7bc82d867_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

44060c7bc5fc98cf30695ce7bc82d867_JaffaCakes118
Size

36KB
MD5

44060c7bc5fc98cf30695ce7bc82d867
SHA1

63932eb171671a053e64595cea8e9ee10bb7c4b0
SHA256

756731afa923a0243642c68e074ea21c3606df4bb18b7bb7623f9701554e39d3
SHA512

9437896da885aa86ec68dd3cddbfd49ab9315c2420b0a26f4203b9d645ef624e9293c7a60bdbba479b13da69b3fc1b8d80aa287c9f3c867256df92e444e506f6
SSDEEP

768:OAwestu2WfpPMZn6sgHdRFejWjTOjjwzeVPtkjp:dstu2WfpEZnwHLFeELj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44060c7bc5fc98cf30695ce7bc82d867_JaffaCakes118

Files

44060c7bc5fc98cf30695ce7bc82d867_JaffaCakes118
.exe windows:5 windows x86 arch:x86

7ce72da8f1739e6febc7251a933c82a1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

forcedos_FE.pdb

Imports

user32

LoadStringW

ntdll

RtlOemStringToUnicodeString
wcschr
RtlInitUnicodeString
RtlUnicodeStringToOemString
RtlInitString

msvcrt

__p__fmode
__set_app_type
__p__commode
_controlfp
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__initenv
exit
_cexit
_XcptFilter
_exit
_c_exit
_except_handler3

kernel32

WriteFile
GetModuleHandleA
GetConsoleOutputCP
GetSystemDefaultLangID
SetThreadLocale
GetFileAttributesW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetEnvironmentVariableW
SearchPathW
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
CloseHandle
GetStdHandle
ExitProcess

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ