2a0d21db30cd8fd32946eddceaed1510_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2a0d21db30cd8fd32946eddceaed1510_JaffaCakes118
Size

170KB
MD5

2a0d21db30cd8fd32946eddceaed1510
SHA1

1a3cdee8b775f15ea36f6ec2c32733ac08ccd23b
SHA256

b3562030880ad59c9881c12b4f19e23ac13f5e237113d5c0626f6b74b009ca40
SHA512

8673865bdcbfecb892f8acfd6af029ea8db847244b22cff04766bc2303f5ed7726ee077988b45fc89fa2dde0fd41295ec8418cca76766d4ed564e7001bb1d22d
SSDEEP

3072:h4mMAeGoyiWu8dpAZDqrpd2ZjtHINadnPolFkV4SfEC4uTbqQsFVg+:h4mM3GaWJdpDVd2jIwCF24gC0IW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2a0d21db30cd8fd32946eddceaed1510_JaffaCakes118

Files

2a0d21db30cd8fd32946eddceaed1510_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ea8a5b2ce28cf3c40af13001ec93ad94

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CLSIDFromString
CoCreateInstance
CoTaskMemFree
StgCreateDocfile

kernel32

ExitProcess
VirtualQuery
GlobalAddAtomA
HeapFree
FlushFileBuffers
RtlUnwind
ReadFile
VirtualProtect
SetFilePointer
HeapAlloc
EnumResourceNamesW
GetOEMCP
WriteFile
GetVolumeInformationW
GetSystemInfo
SetEndOfFile
GetCurrentProcess
FindAtomW

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

setupapi

CM_Get_Depth
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status

comdlg32

ChooseFontA
GetOpenFileNameA

Sections

.text
Size: 92KB - Virtual size: 491KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ