d1fca9d7ea19e55601699878d3888b99_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d1fca9d7ea19e55601699878d3888b99_JaffaCakes118
Size

171KB
MD5

d1fca9d7ea19e55601699878d3888b99
SHA1

0fffcfd0f5a78db27574faee83e9d355b10c3464
SHA256

6aad6513449ac42a068185747706a4ab0f19ef71d872141e4bf3ef4e109e6b6e
SHA512

8bc690724dd5e245e6918349ce3440f1cd180af5fc16cf254cf4462a30203b6ba1e1842c57aee85818fce468cd86b36865cf8b1d38d47ef55809be2ad7a3141b
SSDEEP

3072:/9ocr+PgxoG7R/T4Js8o1xlPU6GYYdNeYT/vYRwxR7QCBZwPPB9RfRn/FDyJ6:/VyGvt20vl6YYdNeWYRwzEXPpjGJ6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d1fca9d7ea19e55601699878d3888b99_JaffaCakes118

Files

d1fca9d7ea19e55601699878d3888b99_JaffaCakes118
.exe windows:4 windows x86 arch:x86

19048ba8c514b1205a07c4a48eb505c8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

lstrcpyA
lstrcpynW
GlobalAlloc
OutputDebugStringW
lstrlenW
LockResource
CheckRemoteDebuggerPresent
lstrcpyW
EnumResourceTypesW
GlobalFree
GetCPInfo
FindClose
MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSection
GetTickCount
DeleteCriticalSection
GetACP
lstrcmpiW
GetLastError
GetModuleHandleW

user32

PostThreadMessageW
SetTimer
GetMessageW
TranslateMessage
CharUpperW
wsprintfW
GetAncestor
CharNextW
GetDC
KillTimer
DispatchMessageW
UnregisterClassA

winspool.drv

DocumentPropertiesW

Sections

.text
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.isete
Size: 1024B - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ