44c5d00336c371d188f0e1399bb67449_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

44c5d00336c371d188f0e1399bb67449_JaffaCakes118
Size

169KB
MD5

44c5d00336c371d188f0e1399bb67449
SHA1

2fc509e4f8d194ee13b25a7131c5c7d94905d1d4
SHA256

95d932771733209af6c96e855c87238dc1c9a70980e4d3857d74b74b3690ea83
SHA512

90bdddbaffcfb4417049d25ebff98507887d54e435e04feaa353569ed58e3e676569d22d4fe563070b149e1e47d27b7dcb3d5faef3509d3630316cbf6e04fa90
SSDEEP

3072:BRwRJ7/WFttcQyicxDoAsSEresp8zSJ244vbC97RrGdhZXbRG8mMQn3:XaJbWhcQyiwoAs9xsARrGdHRGFMQn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44c5d00336c371d188f0e1399bb67449_JaffaCakes118

Files

44c5d00336c371d188f0e1399bb67449_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6e01b2f80288e6f5fbdf665dd488feca

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

setupapi

CM_Get_Depth
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status

kernel32

VirtualQuery
GetSystemInfo
GlobalAddAtomW
SetFilePointer
ExitProcess
WriteFile
GetCurrentProcess
FlushFileBuffers
RtlUnwind
EnumResourceNamesW
GetOEMCP
ReadFile
HeapAlloc
GetStringTypeExW
SetEndOfFile
HeapFree
VirtualProtect
FindAtomW

ole32

CLSIDFromString
CoCreateInstance
CoTaskMemFree
StgCreateDocfile

comdlg32

ChooseFontA
GetOpenFileNameA

Sections

.text
Size: 89KB - Virtual size: 484KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ