b6e1f770b4dab390a20a97851399ff1a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b6e1f770b4dab390a20a97851399ff1a_JaffaCakes118
Size

278KB
MD5

b6e1f770b4dab390a20a97851399ff1a
SHA1

4c54ac2a65e349d84facee2a195ae91c8f7e47f8
SHA256

1856942ddaa6af07bed9365e9848672013c60aa3ededaa7a506c2061f87aaf21
SHA512

3f0afd54b69d4dadcd5bfc8b6b5a2c61759e6549cff2a3676a59c51a3d294798e6ccf665ba6d5dddd41f0e9b5bb673ae54d26d8ec814e4d1888641cd5f0e899c
SSDEEP

6144:clL7BjV31VeH2Iiv9u4Qy2IM7/xbonYyoQ0lZqj5T:ctN51Vuc9HQy2j/wIkj5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b6e1f770b4dab390a20a97851399ff1a_JaffaCakes118

Files

b6e1f770b4dab390a20a97851399ff1a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f10b6a0b679bbbfca1f638d4a0df6aa5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

kernel32

GetCurrentProcess
GetSystemInfo
GlobalAddAtomA
VirtualQuery
SetFilePointer
SetEndOfFile
VirtualProtect
GetOEMCP
RtlUnwind
EnumResourceNamesW
HeapFree
WriteFile
ExitProcess
GetVolumeInformationA
ReadFile
FlushFileBuffers
HeapAlloc
FindAtomW

comdlg32

ChooseFontA
GetOpenFileNameA

ole32

CoCreateInstance
CoTaskMemFree
CLSIDFromString
StgCreateDocfile

setupapi

CM_Get_Depth
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status

Sections

.text
Size: 141KB - Virtual size: 272KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ