14e16cb8f8ac508bbbd95c0121f15db0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

14e16cb8f8ac508bbbd95c0121f15db0_JaffaCakes118
Size

402KB
MD5

14e16cb8f8ac508bbbd95c0121f15db0
SHA1

5b91d9113f4b57bd2cf5c852ae610b488e14712c
SHA256

498c04864823edfa6c11ab850a76cf95272512df8db5e1fbcdc0d35993159746
SHA512

cfebcff76ab7c9ad0302dd83c717e24a82b55e8180a8761f83323fd2490fe8f16d1a2b8fd27c9e5f3a64daa1453d036385892c5b491e94140b2584daf78fa0db
SSDEEP

6144:wDgb1Vd14Vq7aIABW/k9dNfPj82l5E1mldh3L2VN3v/PxAI6I7CVjz:QgRbpG8APjNEmldQRRn97CVj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14e16cb8f8ac508bbbd95c0121f15db0_JaffaCakes118

Files

14e16cb8f8ac508bbbd95c0121f15db0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a920f2f92b87d675d11e85daed799d25

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
LoadLibraryA
lstrcpynA
_llseek
DeleteCriticalSection
GetSystemTime
CreateEventA
HeapReAlloc
InitializeCriticalSection
SetThreadAffinityMask
FileTimeToSystemTime
GetWindowsDirectoryA
lstrcpyA
ExitProcess
ResetEvent
TerminateProcess
GetProcessVersion
FreeLibrary
FileTimeToLocalFileTime
LocalFree
DisableThreadLibraryCalls
GetFileAttributesA
LocalAlloc
GetVersion
LoadResource
GetModuleFileNameA
WideCharToMultiByte
GetProcAddress

user32

IsDlgButtonChecked
wsprintfW
GetWindowInfo
CheckDlgButton
EnumWindowStationsW
EnableWindow

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

Sections

.text
Size: 292KB - Virtual size: 291KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bomex
Size: 4KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ