e12b697b802ac7b28f2d41503d52bb58_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e12b697b802ac7b28f2d41503d52bb58_JaffaCakes118
Size

278KB
MD5

e12b697b802ac7b28f2d41503d52bb58
SHA1

08c2aa655a456b96c12366017e1392f63d970819
SHA256

b9f9674d51935194d19fc16bd333e71765506760b9157b93a6a3e837b4f98189
SHA512

7de7103c1f2a9a4376b68033a2ba019b6939588a1eda9f6272ef1e31167e7d1582c327004e528fc49901e0ec293b5d2750c918f03b922b1a023ac29411a0f95a
SSDEEP

6144:GtvsvqZWModVXAZ1c5aMSYAaygPNkCuZtPYBiCE/7S/vA:0UWWPXAZ1caykhZyvE/7SX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e12b697b802ac7b28f2d41503d52bb58_JaffaCakes118

Files

e12b697b802ac7b28f2d41503d52bb58_JaffaCakes118
.exe windows:4 windows x86 arch:x86

153232a4934d0a7c3c63b3516ddada44

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoCreateInstance
CoTaskMemFree
CLSIDFromString
StgCreateDocfile

kernel32

SetFilePointer
GlobalAddAtomA
GetSystemInfo
VirtualQuery
ReadFile
RtlUnwind
SetEndOfFile
HeapAlloc
ExitProcess
EnumResourceNamesW
FlushFileBuffers
GetVolumeInformationW
GetCurrentProcess
WriteFile
VirtualProtect
HeapFree
GetOEMCP
FindAtomW

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

setupapi

CM_Get_Depth
CMP_WaitNoPendingInstallEvents
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status

comdlg32

ChooseFontA
GetOpenFileNameA

Sections

.text
Size: 142KB - Virtual size: 278KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ