5f38ceed66f02f213b004dd2fbf74dae_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5f38ceed66f02f213b004dd2fbf74dae_JaffaCakes118
Size

11KB
MD5

5f38ceed66f02f213b004dd2fbf74dae
SHA1

b16c2827d9046fa5115d92e491834bd27bb3b365
SHA256

46c2061f3c075ac1494352e03388dec8d0978301423efc0eb6b19764ff726e31
SHA512

dd6462d130f1ef99a233bd4f38b28f54fec82333921af683bb08b4fd7adc1a1b45cb64f89c4b8ac6a9b7b7f3f48ed0c61d355d0f1f4dbe74140b6cb903b2fd08
SSDEEP

192:pdycdc7Y9svVWh2ZgapSWUuiKS5AJhIO7YpmW+YJW:pdyn9WhogaMDuiKSGhT7YpmW+YJW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5f38ceed66f02f213b004dd2fbf74dae_JaffaCakes118

Files

5f38ceed66f02f213b004dd2fbf74dae_JaffaCakes118
.exe windows:5 windows x86 arch:x86

901647755c66513745bee4f5aae1bcb5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

msvcrt

exit

advapi32

RegCloseKey

user32

wsprintfW

winspool.drv

OpenPrinterW

spoolss

DllFreeSplMem

rpcrt4

NdrServerCall2

ntdll

NtCreatePort

Sections

.MPRESS1
Size: 8KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE