72a5bb0313b4403b505bc153b6e944a5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

72a5bb0313b4403b505bc153b6e944a5_JaffaCakes118
Size

279KB
MD5

72a5bb0313b4403b505bc153b6e944a5
SHA1

6c354fe697ef3d19278d94602aae97dd5c17b7e8
SHA256

499169e79ea3133af4040c17451848370e509e10cf2d0404296fafab05dfd0f0
SHA512

f773e49bacdec1556ff65ccb4704119b9637f076b0b53b7325829855b5b3b02c7dd8455ca7b738c848d23061e48473d534cba691dd2dd6b1ac3a995dd1cb178f
SSDEEP

6144:KG9MKZWfNTnhQWnWREJ7kwMA+dK1pEFBdRB7o:K6MBNTtnWEVO9kTETf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
72a5bb0313b4403b505bc153b6e944a5_JaffaCakes118

Files

72a5bb0313b4403b505bc153b6e944a5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e2c89d25224b7def2f2a8ad68c30341e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlUnwind
HeapAlloc
GlobalAddAtomA
ExitProcess
SetEndOfFile
VirtualProtect
GetCurrentProcess
SetFilePointer
VirtualQuery
WriteFile
EnumResourceNamesW
HeapFree
GetSystemInfo
GetVolumeInformationA
FlushFileBuffers
GetOEMCP
ReadFile
FindAtomW

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

setupapi

CM_Get_Depth
CMP_WaitNoPendingInstallEvents
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status

comdlg32

ChooseFontA
GetOpenFileNameA

ole32

CLSIDFromString
CoTaskMemFree
CoCreateInstance
StgCreateDocfile

Sections

.text
Size: 147KB - Virtual size: 278KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 129KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ