3b718a05dcf4db8bae08962dd0c46329_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3b718a05dcf4db8bae08962dd0c46329_JaffaCakes118
Size

279KB
MD5

3b718a05dcf4db8bae08962dd0c46329
SHA1

b1b5f491fbec4f18df0bf3dde474730eab4e0a9e
SHA256

d6ed7dc1b5c6635c6cdc8a9ac1ce369fca547d85df0fedd5c4886fe206c312de
SHA512

dcc9006f782319a406c7cb2d18d7916beaa0e3fb8ef9a972093f0750ad53730ed229b01b209924ff8bd58c8733dfa3c2c4d0b0abe144362075f1c3fb2972c8a8
SSDEEP

3072:VYZOuc0aegEXya6bc+NiOZWWki24qW3t6KXDi9zuYyBOVXwWLD9GtQ4q3bOxD:mZOupAbV9WWU4qW3wKusYy4tpMtbm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b718a05dcf4db8bae08962dd0c46329_JaffaCakes118

Files

3b718a05dcf4db8bae08962dd0c46329_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ba02e16f9cceffc80b19d43f7a9d42bc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlUnwind
GlobalAddAtomW
FlushFileBuffers
SetFilePointer
SetEndOfFile
VirtualProtect
ExitProcess
ReadFile
GetOEMCP
EnumResourceNamesW
VirtualQuery
HeapFree
GetSystemInfo
GetStringTypeExW
HeapAlloc
WriteFile
GetCurrentProcess
FindAtomW

comdlg32

ChooseFontA
GetOpenFileNameA

ole32

CoTaskMemFree
CoCreateInstance
CLSIDFromString
StgCreateDocfile

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

setupapi

CM_Get_Depth
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status

Sections

.text
Size: 145KB - Virtual size: 277KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ