c91c43b8e13e06592dd42bf573436b5c_JaffaCakes118 | Triage

Sharing

General

Target

c91c43b8e13e06592dd42bf573436b5c_JaffaCakes118
Size

170KB
MD5

c91c43b8e13e06592dd42bf573436b5c
SHA1

9b26f1e2aaca596f9f2d281ddb4142eaf20c75cb
SHA256

c0efc46a64efc18afa683b96bf6ff3e1f1eb81795f1f5f3a47d23307be232e0c
SHA512

203ba76a5e25ad217ffb3f089d3bd04dbd4a0d70c5b5ee25d57b0d93b896c757ef30ef07882095421c5633d11355b0732274d6e4590b8064db30b75ff45789cf
SSDEEP

3072:cAQjkyAZkJdRXiXsdsdGL2sCAC7vefX7Uyq8+lnm9A:cAwNXiXesEL2sCBGoyqN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c91c43b8e13e06592dd42bf573436b5c_JaffaCakes118

Files

c91c43b8e13e06592dd42bf573436b5c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

902ad7616da30fcfb6584c3eaad1619e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoCreateInstance
CoTaskMemFree
CLSIDFromString
StgCreateDocfile

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

kernel32

RtlUnwind
GlobalAddAtomA
GetOEMCP
GetCurrentProcess
HeapFree
VirtualQuery
HeapAlloc
SetFilePointer
EnumResourceNamesW
ReadFile
WriteFile
FlushFileBuffers
GetLongPathNameA
VirtualProtect
SetEndOfFile
GetSystemInfo
ExitProcess
FindAtomW

setupapi

CM_Get_Depth
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status

comdlg32

ChooseFontA
GetOpenFileNameA

Sections

.text
Size: 93KB - Virtual size: 489KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ