42e96234d828a928253be803c65a3f94_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

42e96234d828a928253be803c65a3f94_JaffaCakes118
Size

114KB
MD5

42e96234d828a928253be803c65a3f94
SHA1

7ed55766e2cd2387b7bd12ea2a0bb19aeaa8caa3
SHA256

1617a22c6461475c53c99187662b50db7d2d37466656032dfde4bfea7b71be6c
SHA512

c892c957928138c62af5a817654d5b2648db1271d981e9efb2825677e33254711d366dca72415a578618444d220ede62f9adcd5cb02875dd069c325f8039f189
SSDEEP

1536:8jffRFABkF5oim226fQtGVbnE3PWxTOSl0BG+zOZelNpog:4XRFAOF9brbnEfWxzlSGbelNpV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42e96234d828a928253be803c65a3f94_JaffaCakes118

Files

42e96234d828a928253be803c65a3f94_JaffaCakes118
.exe windows:5 windows x86 arch:x86

9ce47cd38e3836a12f83bf9f62617956

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetCommState
FlushProcessWriteBuffers
GetThreadId
lstrlenA

advapi32

DeleteService

winspool.drv

AddPrintProvidorW

shlwapi

SHDeleteKeyA

user32

LoadImageW

gdi32

SetDCPenColor
GetFontUnicodeRanges

Sections

.text
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ