14f9011acd7a2208436e81370e5a6230_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

14f9011acd7a2208436e81370e5a6230_JaffaCakes118
Size

170KB
MD5

14f9011acd7a2208436e81370e5a6230
SHA1

258e9de314904e998eb1bdfe2c0497eddf8933fc
SHA256

bc7c7cca61c9826fa73757afaa12605c01a416085075f4a837baf86b5fcae70d
SHA512

992813c9d53593c0011c6cd5a89cdec405f9be6d8bd51d9459dc505fcdac1857bef83eedabc67c6a09e38a3b10518ce12f8e022dab26b9a274496152d6456382
SSDEEP

3072:cAQjhyAZkJdRXiXsdsdGL2sCAC7vefX7Uyq8+lnm9A:cA9NXiXesEL2sCBGoyqN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14f9011acd7a2208436e81370e5a6230_JaffaCakes118

Files

14f9011acd7a2208436e81370e5a6230_JaffaCakes118
.exe windows:4 windows x86 arch:x86

902ad7616da30fcfb6584c3eaad1619e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoCreateInstance
CoTaskMemFree
CLSIDFromString
StgCreateDocfile

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

kernel32

RtlUnwind
GlobalAddAtomA
GetOEMCP
GetCurrentProcess
HeapFree
VirtualQuery
HeapAlloc
SetFilePointer
EnumResourceNamesW
ReadFile
WriteFile
FlushFileBuffers
GetLongPathNameA
VirtualProtect
SetEndOfFile
GetSystemInfo
ExitProcess
FindAtomW

setupapi

CM_Get_Depth
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status

comdlg32

ChooseFontA
GetOpenFileNameA

Sections

.text
Size: 93KB - Virtual size: 489KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ