104d31d4a6159894881b1a3cbffe6678_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

104d31d4a6159894881b1a3cbffe6678_JaffaCakes118
Size

115KB
MD5

104d31d4a6159894881b1a3cbffe6678
SHA1

97812a8b58bbf7be289719c36f41aebc4ff42322
SHA256

b90da2952f681ef1b3502732eb5edaeed8db18316bb4954f55e7bd0bf3fb4de3
SHA512

dc149ad07eb31d6ea635e451966b70d5fa2347e357b958287ebd36f2af063d6158458decbdbc72864f07a730c2881cdead49aedf76c8c5044f3252e8596e2294
SSDEEP

1536:EAF00Jz2CcpaA3Z9CIL9TLjTlsbmJGOLc8HRwawx6Fe:r+Oz2vaAJ9VdICGOLbxW6A

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
104d31d4a6159894881b1a3cbffe6678_JaffaCakes118

Files

104d31d4a6159894881b1a3cbffe6678_JaffaCakes118
.exe windows:5 windows x86 arch:x86

91466f0a146e554d18d42d22f292bcac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

SetDCPenColor
GetFontUnicodeRanges

shlwapi

SHDeleteKeyA

winspool.drv

AddPrintProvidorW

kernel32

lstrlenA
GetThreadId
FlushProcessWriteBuffers
SetCommState

advapi32

DeleteService

user32

LoadImageW

Sections

.text
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ