ea0251b1912353105e56510979debe5e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ea0251b1912353105e56510979debe5e_JaffaCakes118
Size

170KB
MD5

ea0251b1912353105e56510979debe5e
SHA1

ff6bf10bdcf4253811171c2d45a4282058a7ccb1
SHA256

19b56edf07ff9af756372232e631477c18fcbd7820667aa6c988b5846c55e707
SHA512

64e06362c5bc5d5ed9ed03dba262a544119e4d74c9f24805b9ed70902c94845e204f6791a1c9fa401656b85065472d5c34eda228407201802ccfeb40169297ba
SSDEEP

3072:tD0QEuAxJzeHMKD3llqDnO/8791pK9x48mM1xjAqDne72UndmcWKsylvH:xhRS7KyR7npKTfmM1q2DIdplvH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ea0251b1912353105e56510979debe5e_JaffaCakes118

Files

ea0251b1912353105e56510979debe5e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

89fd060d1434791414675081a8e49787

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalAddAtomA
ExitProcess
RtlUnwind
SetUnhandledExceptionFilter
Sleep
LoadLibraryExW
InterlockedCompareExchange
FindClose
EnumResourceNamesW
QueryPerformanceCounter
GetStartupInfoA
InterlockedExchange
GetCurrentThreadId
GetLongPathNameA
GetTickCount
FreeLibrary
GetProcAddress

ole32

CLSIDFromString
CoCreateInstance
CoTaskMemFree
StgCreateDocfile

comdlg32

ChooseFontA
GetOpenFileNameA

setupapi

CM_Get_Depth
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

Sections

.text
Size: 94KB - Virtual size: 489KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ