ef483d4cde9c99aadbc00a79b9d4e44f_JaffaCakes118 | Triage

Sharing

General

Target

ef483d4cde9c99aadbc00a79b9d4e44f_JaffaCakes118
Size

123KB
MD5

ef483d4cde9c99aadbc00a79b9d4e44f
SHA1

7c8028d03cd1352d9b0a7481774f41152419365a
SHA256

16695968943ab1fc671d04f0b413346d52ad83ab250dd93175e2c67f8ccb0b8c
SHA512

0bd381f51e7cbe155bcb75a176eb4d231ba631a21492063542ace75f79f0b0cfdba22cf488f4264da2da1ad44b4f437581f22e3fdd5e28fe3a0c759cf1744087
SSDEEP

1536:HB70GX/7jTOULsUIqqhrtmRN2CXI7rTUPGWJnuvphVHcTtHFmvmE0:lhvBcqqRAzFX8/UzmDcTtHF40

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ef483d4cde9c99aadbc00a79b9d4e44f_JaffaCakes118

Files

ef483d4cde9c99aadbc00a79b9d4e44f_JaffaCakes118
.exe windows:5 windows x86 arch:x86

4ce8526ae28400fb2003ffe7ce2e1ce6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_SYSTEM
IMAGE_FILE_BYTES_REVERSED_HI

Imports

winspool.drv

OpenPrinterW

msi

ord30

shell32

ShellAboutW
DragQueryFileW
SHGetDiskFreeSpaceExA
DragFinish
SHGetDesktopFolder
ShellExecuteExW
SHAppBarMessage

kernel32

GetModuleFileNameA
GetModuleHandleA
GetBinaryTypeA
GetCurrentProcess
GetCommandLineW

version

VerInstallFileA

Sections

.AD8Te
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ