fa756ba217e1ce4d12644a9f3c0c97a0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fa756ba217e1ce4d12644a9f3c0c97a0_JaffaCakes118
Size

155KB
MD5

fa756ba217e1ce4d12644a9f3c0c97a0
SHA1

faf06a245675c619dc86043b0febb8a72bc0ad49
SHA256

93703dfe71b0760891670f82393cd3338d89e8f8919936c3c758c040801a9bee
SHA512

246f0837bdeaac4d675530e17310b9d12324110fbca3da091fd9c643b2b6ca12d4a20b4ef8168c82f5e7892363649bb485564bb2a9ce611bc19021cab15a408f
SSDEEP

3072:/NazG2TPJyjJxX2N6EOc36Z0OxfKBOrS6/yTHnygTa8ulJdDCrevd:/NazRPUjGNnFqZ1b/bgTa8ulJdOyvd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa756ba217e1ce4d12644a9f3c0c97a0_JaffaCakes118

Files

fa756ba217e1ce4d12644a9f3c0c97a0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6aa13f8d242fd3f56ee74d63bc7f8cdd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

lstrcmpiW
GlobalFree
lstrcpynW
MultiByteToWideChar
DeleteCriticalSection
GlobalAlloc
CheckRemoteDebuggerPresent
lstrcpyA
LockResource
GetCPInfo
EnumResourceTypesW
GetACP
GetLastError
FindClose
lstrcpyW
lstrlenW
WideCharToMultiByte
InitializeCriticalSection
GetTickCount
OutputDebugStringW
GetModuleHandleW

winspool.drv

DocumentPropertiesW

user32

KillTimer
GetMessageW
TranslateMessage
GetAncestor
DispatchMessageW
CharUpperW
PostThreadMessageW
CharNextW
SetTimer
wsprintfW
GetDC
UnregisterClassA

Sections

.text
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.isete
Size: 1024B - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ