56c50c9ce22b4097df65f65a282b3b82_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

56c50c9ce22b4097df65f65a282b3b82_JaffaCakes118
Size

35KB
MD5

56c50c9ce22b4097df65f65a282b3b82
SHA1

94b3164f6411856816c4451f964a5fd82a0cdf67
SHA256

4364a12d0b2c3e9e1409ae45fc8c5ce75b3f719c86981ff40c0cb88d8b443d53
SHA512

bdd72c877d3eba1db33ebe6986cf5b602f961e5d09d50d89469a4359f89bba86f580a8c8b54b9c9eb9a8b93edc8e21c4a09a3da1a59b1bfb7f1286a608b35558
SSDEEP

768:pBK7S3cBvIEYOt6PcZgbxi6prD1JXNroVuCgkjQaD1:H+S3uvlYOURpf1JXN0V/ka

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
56c50c9ce22b4097df65f65a282b3b82_JaffaCakes118

Files

56c50c9ce22b4097df65f65a282b3b82_JaffaCakes118
.exe windows:5 windows x86 arch:x86

c6252fccf829b9d03821f28adaf32c75

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
_except_handler3
_initterm
__getmainargs
__initenv
exit
_write
_cexit
_XcptFilter
__setusermatherr
_exit
_c_exit

advapi32

RegSetValueExA
RegQueryValueExA
RegCreateKeyA
GetUserNameA
RegCloseKey

kernel32

GetTickCount
FormatMessageA
LocalFree
GetComputerNameA
GetFileSize
_lclose
GetModuleHandleA
OpenFile
_lread

lprhelp

WriteJobData
StartJob
InitiateConnection
CloseLPR
CancelJob
OpenLPR
EndJob

user32

CharToOemBuffA

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

vxavkfj
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE