ac4946ecd192a0d9520742804a10b976_JaffaCakes118 | Triage

Sharing

General

Target

ac4946ecd192a0d9520742804a10b976_JaffaCakes118
Size

402KB
MD5

ac4946ecd192a0d9520742804a10b976
SHA1

98ed38179bd3f7939124812b6cc74b0af80cbfa5
SHA256

f6fb6b23cf485d5ec561e5764dce283cfe1126ef57d0e9a8eecd4c9ddd4da976
SHA512

f333571c670069798d05797052b41ebd739de45cd83f8a57c4a9b058d3a6cc5b19734333f72947425d756c88c387e155b9319e9d9f71d4f5aa63c3639c87a80f
SSDEEP

6144:wDgb1Vd14Vq7aIABW/k9dNfPj82l5E1mldh3L2VN3v/BxAI6I7CVjz:QgRbpG8APjNEmldQRPn97CVj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ac4946ecd192a0d9520742804a10b976_JaffaCakes118

Files

ac4946ecd192a0d9520742804a10b976_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a920f2f92b87d675d11e85daed799d25

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
LoadLibraryA
lstrcpynA
_llseek
DeleteCriticalSection
GetSystemTime
CreateEventA
HeapReAlloc
InitializeCriticalSection
SetThreadAffinityMask
FileTimeToSystemTime
GetWindowsDirectoryA
lstrcpyA
ExitProcess
ResetEvent
TerminateProcess
GetProcessVersion
FreeLibrary
FileTimeToLocalFileTime
LocalFree
DisableThreadLibraryCalls
GetFileAttributesA
LocalAlloc
GetVersion
LoadResource
GetModuleFileNameA
WideCharToMultiByte
GetProcAddress

user32

IsDlgButtonChecked
wsprintfW
GetWindowInfo
CheckDlgButton
EnumWindowStationsW
EnableWindow

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

Sections

.text
Size: 292KB - Virtual size: 291KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bomex
Size: 4KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ