29e91448059eeb808568ff6602e496c1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

29e91448059eeb808568ff6602e496c1_JaffaCakes118
Size

278KB
MD5

29e91448059eeb808568ff6602e496c1
SHA1

4b9a34a5159c521fd59ca0d9087e57e5bc8cd248
SHA256

1262da4459d87512e2beaf97f35682ee3f032e9d678e9fc939af375c35e0dc55
SHA512

4ace9de3659ea012ade8fbd5403fe9f101b1e19219916d9637cf20b1c9767639c0fa3119fd37f70d1b59ea19bdd23bc187a86f29c1f5b5a006c9fa8e7a24ca16
SSDEEP

6144:clL7BjV31VeH2Iiv9u4Qy2IM7/xbonYyoQ0lZqj5T:ctN51Vuc9HQy2j/wIkj5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29e91448059eeb808568ff6602e496c1_JaffaCakes118

Files

29e91448059eeb808568ff6602e496c1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f10b6a0b679bbbfca1f638d4a0df6aa5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

kernel32

GetCurrentProcess
GetSystemInfo
GlobalAddAtomA
VirtualQuery
SetFilePointer
SetEndOfFile
VirtualProtect
GetOEMCP
RtlUnwind
EnumResourceNamesW
HeapFree
WriteFile
ExitProcess
GetVolumeInformationA
ReadFile
FlushFileBuffers
HeapAlloc
FindAtomW

comdlg32

ChooseFontA
GetOpenFileNameA

ole32

CoCreateInstance
CoTaskMemFree
CLSIDFromString
StgCreateDocfile

setupapi

CM_Get_Depth
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status

Sections

.text
Size: 141KB - Virtual size: 272KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ