d1885985489f81155df67c1799a5e608_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d1885985489f81155df67c1799a5e608_JaffaCakes118
Size

352KB
MD5

d1885985489f81155df67c1799a5e608
SHA1

bf6cac37cb9405a3a567a85e546aa1505e87ad5f
SHA256

3288fa6ded8495cd7a51d6dde521725be41813f320cf6a45859ebd537ee85acd
SHA512

0b8e89f2bd9558fdc6dcc03475d5a52b0fec8055904ec9b797200e843681077be543377b6ceeaab5a8b979ec64e45a961c554e3d266e7c936d8261289d3b2429
SSDEEP

6144:cy+fzUTru0W18InCP+Tt0fEkKaXzeozHZK699EbzkMKWfBs890xopZnRXfbf5K:BSzqabLTkEkKaXzeozoiEbH4qN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d1885985489f81155df67c1799a5e608_JaffaCakes118

Files

d1885985489f81155df67c1799a5e608_JaffaCakes118
.exe windows:5 windows x86 arch:x86

28f5a8ce3ccf676d28f4d15d0f8c101e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

DrawTextExA

advapi32

RegOpenKeyExA

psapi

GetModuleFileNameExA

oleacc

LresultFromObject

gdi32

DeleteDC

winspool.drv

DocumentPropertiesA

oleaut32

VariantClear

Sections

.text
Size: 253KB - Virtual size: 556KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 97KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE