aa932e8f463384818a23667673de9a4d_JaffaCakes118 | Triage

Sharing

General

Target

aa932e8f463384818a23667673de9a4d_JaffaCakes118
Size

276KB
MD5

aa932e8f463384818a23667673de9a4d
SHA1

54654b74ba1ed2896920a1a97e273881dc7160dd
SHA256

f892603cf6fa01d7c87bd7a14c6813fe84b052863d7b65248fc8ba72a2ae8189
SHA512

5acf4c53c7dfbe25128e2ab18e882cde370c9b854592bf8e99f5bddd5f28865bb97fee2cdb971354ee0813379d718abd3f5438af50f19710ce0659b02c9adcb4
SSDEEP

6144:Wd7DKqo4vJwWM5h7YjCOw0Ly+JlMfXN+ku/idcz:Hqo4BqcCOw0Ly+z1koiA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa932e8f463384818a23667673de9a4d_JaffaCakes118

Files

aa932e8f463384818a23667673de9a4d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0d5a75c1a1fb03aa91395e7d416f32c3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

shlwapi

PathFindExtensionW
PathFindFileNameW

oleacc

CreateStdAccessibleObject
LresultFromObject

gdiplus

GdipBitmapUnlockBits
GdipCreateBitmapFromStream
GdipGetImageWidth

kernel32

WriteFile
GlobalAddAtomW
SetFilePointer
GetOEMCP
FlushFileBuffers
RtlUnwind
HeapFree
VirtualProtect
SetEndOfFile
EnumResourceNamesW
VirtualQuery
GetStringTypeExW
GetSystemInfo
ReadFile
ExitProcess
HeapAlloc
GetCurrentProcess
FindAtomW

setupapi

CM_Get_Depth
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status

Sections

.text
Size: 137KB - Virtual size: 272KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ