043dca168e43a03263bb4dc6d3548a88_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

043dca168e43a03263bb4dc6d3548a88_JaffaCakes118
Size

132KB
MD5

043dca168e43a03263bb4dc6d3548a88
SHA1

5aa1313e2de1894263588115131aa47928bb4cc8
SHA256

a75e93f9a66fb0471f34ce4316abf2c4307105ec2528caafb61492b136569612
SHA512

f3574f72b3d83dd93d919e0b003eed789dfae2549811e1efff2341125370fad9c053686e9c7477f4b6f2fabb3af599b5177d7b8fc23fb508fdc82d5acbef926e
SSDEEP

3072:CeBMy3MP1noQ9RCPjXpyYVd2m7VE2IsBMJ6w7ambisa+DKQfn:C434n8jZygd1CC5/+DN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
043dca168e43a03263bb4dc6d3548a88_JaffaCakes118

Files

043dca168e43a03263bb4dc6d3548a88_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fb7d98e9d7eb8b16dce8c359ff3ba7be

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

kernel32

TerminateThread
GetConsoleMode
CreateIoCompletionPort
GetStringTypeW
GetLocaleInfoA
LCMapStringA
GetStringTypeA
EnumResourceNamesW
RaiseException
ExitProcess
HeapSize
GetConsoleCP

Sections

.text
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rscr
Size: 512B - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ