1a54a121ab8e0f0799cfb3144e6d7608_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1a54a121ab8e0f0799cfb3144e6d7608_JaffaCakes118
Size

185KB
MD5

1a54a121ab8e0f0799cfb3144e6d7608
SHA1

325f44c52f1e6206f1b92033c3caeb8d60294d27
SHA256

50eadb1a8826b63f2553f5fbcffb92e2b63494a854ec7f1a0151c7a3118b6321
SHA512

6ed0c0bf55554b3b6b886e8d4e6bee84b9b481e2585dc3f9fb7add4b8d7d8651923ca53d3267306d9534ff28e62c42907cfdf46f9723a54f4a0dbab820d0329a
SSDEEP

3072:Yu0I1HBhpZe9d3z8vA9RfPPIKwNioys2x7lara7VKExi:zFjwVbSTAPa+hPx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a54a121ab8e0f0799cfb3144e6d7608_JaffaCakes118

Files

1a54a121ab8e0f0799cfb3144e6d7608_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a8d5837e1884809331eeed7c3836089c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

comdlg32

ChooseFontA
GetOpenFileNameA

setupapi

CM_Get_Depth
CMP_WaitNoPendingInstallEvents
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status

kernel32

GetCurrentProcess
GlobalAddAtomA
ExitProcess
HeapAlloc
VirtualQuery
HeapFree
SetFilePointer
RtlUnwind
EnumResourceNamesW
GetOEMCP
ReadFile
WriteFile
VirtualProtect
GetVolumeInformationA
GetSystemInfo
FlushFileBuffers
SetEndOfFile
FindAtomW

ole32

CLSIDFromString
CoCreateInstance
CoTaskMemFree
StgCreateDocfile

Sections

.text
Size: 96KB - Virtual size: 239KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ