778f0087f39113a1d3f4a45549007d67_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

778f0087f39113a1d3f4a45549007d67_JaffaCakes118
Size

168KB
MD5

778f0087f39113a1d3f4a45549007d67
SHA1

a7262aefa31a1534b75b2468c4adaf13cd20b179
SHA256

9b42300bc153e3499254d8aa5c0053d57c7918d7dd3e524dcf4e562476b5d0a0
SHA512

46f8e3eaebbfde76f49bbc127bcde4348a63bb3b136cfec98f1a43e389b31a1d1c9a0a4b8a8c0d8554aad7cb460841efa70a5b45d5fc9b7fbf87150b8de4d3c7
SSDEEP

3072:jsHQySnsirjxQdI4NETcBJJjMeagjWNFUzuuegPz5poi:IHQyVqjJ4G4BJ+iWNFqtPQi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
778f0087f39113a1d3f4a45549007d67_JaffaCakes118

Files

778f0087f39113a1d3f4a45549007d67_JaffaCakes118
.exe windows:4 windows x86 arch:x86

54c171d9241d23817ae6938b0c55f08a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

shlwapi

PathFindExtensionA
PathFindFileNameA

oleacc

CreateStdAccessibleObject
LresultFromObject

gdiplus

GdipBitmapUnlockBits
GdipCreateBitmapFromStream
GdipGetImageWidth

setupapi

CM_Get_Depth
CMP_WaitNoPendingInstallEvents
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status

kernel32

RtlUnwind
HeapAlloc
GlobalAddAtomW
ExitProcess
FlushFileBuffers
VirtualProtect
GetCurrentProcess
WriteFile
EnumResourceNamesW
GetSystemInfo
ReadFile
SetEndOfFile
VirtualQuery
GetStringTypeExW
HeapFree
GetOEMCP
SetFilePointer
FindAtomA

Sections

.text
Size: 86KB - Virtual size: 486KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ