c862f12ee593d1850c5362b4e37139e0_JaffaCakes118 | Triage

Sharing

General

Target

c862f12ee593d1850c5362b4e37139e0_JaffaCakes118
Size

170KB
MD5

c862f12ee593d1850c5362b4e37139e0
SHA1

044b9d007ea35ce2c407cbb047637928405a11fc
SHA256

2c1903e91fec6baa68259d2702ff43ca00a38bb87401c2bdc708aba49d9f4430
SHA512

cd9f73ab48d42fd07da21b99697effc39dba88b13d55b59ab3134385e342594e74c67e2814f4c7b4d8f39d62ee8513b7a2613930b4809138cddbc05df9b6333b
SSDEEP

3072:zmcj+WH6J4mqjAQaroWSr0+01tRMI3Y+LNyS+wchDE7wWWaYDRSp7Ob9Lr:7ZtmqjAQF0drRNbNd+dDEZcDRSVOd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c862f12ee593d1850c5362b4e37139e0_JaffaCakes118

Files

c862f12ee593d1850c5362b4e37139e0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3130be1a6f1a147c36f97e0d542b8403

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

CM_Get_Depth
CMP_WaitNoPendingInstallEvents
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status

ole32

CLSIDFromString
CoTaskMemFree
CoCreateInstance
StgCreateDocfile

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

kernel32

GlobalAddAtomA
SetFilePointer
WriteFile
VirtualProtect
GetSystemInfo
VirtualQuery
ExitProcess
HeapAlloc
FlushFileBuffers
EnumResourceNamesW
SetEndOfFile
RtlUnwind
ReadFile
GetVolumeInformationW
HeapFree
GetCurrentProcess
GetOEMCP
FindAtomW

comdlg32

ChooseFontA
GetOpenFileNameA

Sections

.text
Size: 90KB - Virtual size: 490KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ