cfb956bf176bfe90bbcd79c3c3b49282_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cfb956bf176bfe90bbcd79c3c3b49282_JaffaCakes118
Size

1.1MB
MD5

cfb956bf176bfe90bbcd79c3c3b49282
SHA1

a042e390e23867d58f8b386bb2fd0cbad3a19018
SHA256

05b84ad0668e724f01a5e6111db5aa6b85ab5bd56989a20979cd635c24cb0b37
SHA512

7afe033ca7a92d3cb76c89547e57ea468c65371b792295f5f299452baa25dc82ec1935448ed1cac7d5de5883413b9f3cde8c60533735b0cc2a8ee5cd7f44b6d9
SSDEEP

24576:rs3Uw5fQfj9D2rTiY+3oRbLT/tdszaCs2aNW11c:rsjIfjUTQ3oNLT/z4aGaNWA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cfb956bf176bfe90bbcd79c3c3b49282_JaffaCakes118

Files

cfb956bf176bfe90bbcd79c3c3b49282_JaffaCakes118
.exe windows:1 windows x86 arch:x86

305ee174dcaa7a44689cc18d40d37a5d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetCommandLineA
FindNextVolumeMountPointA
VirtualFree
FindNextChangeNotification
WriteConsoleOutputA
GetPrivateProfileStructA
GetConsoleWindow
RegisterWaitForSingleObjectEx
GetLogicalDriveStringsA
GetExitCodeThread
VirtualProtect
GetTempPathA
ProcessIdToSessionId
VirtualAlloc

winspool.drv

DeletePrinterDriverA

Sections

.text
Size: 391KB - Virtual size: 390KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 735KB - Virtual size: 734KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ