3e82edd8414085dc509a569b8724dd71_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3e82edd8414085dc509a569b8724dd71_JaffaCakes118
Size

158KB
MD5

3e82edd8414085dc509a569b8724dd71
SHA1

4a80fcf6ea5018d8a8ead365d7a5a74b164b5f12
SHA256

7a6de2825accbd77371d590f6538b8a97bc35593804691b5a721c3298a538a55
SHA512

bc6165bb1a3590c57e01b670ce52fd42ab37b864ccb78d89a6935a781525a758b56ee27d19753684537b03e8d03059af65115733b868dbcef1b9bc0e4fd1710b
SSDEEP

3072:EZoP4ZDdCkxdjONhYKKyookd3HXdioMmwleI/hXIhVPTM:EZ/JjlYiHooyI3hZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e82edd8414085dc509a569b8724dd71_JaffaCakes118

Files

3e82edd8414085dc509a569b8724dd71_JaffaCakes118
.exe windows:4 windows x86 arch:x86

045ebd0b5d07b349594fb884f55dfc3b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

winspool.drv

DocumentPropertiesW

user32

LoadCursorW
RegisterClassExW
GetDC
CreateWindowExW
GetWindowInfo
MessageBoxW
GetAncestor
EndDialog

kernel32

lstrcpynW
TlsFree
CheckRemoteDebuggerPresent
TlsSetValue
EnumResourceTypesW
InitializeCriticalSection
TlsAlloc
TlsGetValue
GetStartupInfoA
GetFileType

Sections

.text
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.apexi
Size: 1024B - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ