11ae416879a7ce1f250dc10759e0d9d0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

11ae416879a7ce1f250dc10759e0d9d0_JaffaCakes118
Size

176KB
MD5

11ae416879a7ce1f250dc10759e0d9d0
SHA1

0b5d32969e3defa91487f86f0432694a53065ec7
SHA256

6d4d4d50cb4eb536c9b31dc582829f12f124520ba4c3c4b7e1c06885e4e14ce4
SHA512

d541c8d01d0ba782a45670a5b2538f9deba762d6b45b912967d2af6ee8d80031af5091c275a320755a03b3030ab31630f5523c99c5aaa1e8889c8e3acfc1783b
SSDEEP

3072:Cm1SMX8Y5fa6xfvQPBtR0L9Lv20c2shk4O9wrtAWU:C8SMXpnQPBTY9Lu/hhvV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11ae416879a7ce1f250dc10759e0d9d0_JaffaCakes118

Files

11ae416879a7ce1f250dc10759e0d9d0_JaffaCakes118
.exe windows:6 windows x86 arch:x86

f5c7e20dbfbd12d0f0cc214a494e07a0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

secur32

FreeContextBuffer

kernel32

GetUserDefaultUILanguage
GetFileSize
GetBinaryTypeW
LocalHandle
FindResourceExA
LocalLock
DeleteVolumeMountPointW
FormatMessageW
IsThreadAFiber
GetCommConfig
lstrcmpW
FindFirstVolumeMountPointW
GetLargestConsoleWindowSize

gdi32

GetTextCharset

winspool.drv

DeletePrinterDriverExW

advapi32

EnumServicesStatusExW
InitiateSystemShutdownA
LookupAccountSidW

user32

GetKeyboardLayoutList
GetClipboardViewer
IsCharLowerW
GetMenuBarInfo
GetTabbedTextExtentW
DrawTextExA
GetLastInputInfo

msvcrt

ungetwc
fwprintf

winscard

SCardGetProviderIdA

Sections

.text
Size: 156KB - Virtual size: 154KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ