f65953064573c45a925f00aa50545a71_JaffaCakes118 | Triage

Sharing

General

Target

f65953064573c45a925f00aa50545a71_JaffaCakes118
Size

171KB
MD5

f65953064573c45a925f00aa50545a71
SHA1

5e28cbc7b4d48e2fd529b563964e490bbdd44e61
SHA256

b706ccbb9fd0401fe3ac0bb6799ca29c031de6eb9c2f859f60442a02e96c8308
SHA512

164683d2b8aaa0b7ab939c43fa666acc669efe8c8d6c6743d26780f763a23d48943486d00e8592b8520e2d24981e70716bb5b3a7568ae3d7d0534e9177014813
SSDEEP

3072:/9ocr+PgxoG7R/T4Js8o1xlPU6GYYdNeYT/vYRwxR7QCBZwPPB9RfRn/FDyJ6:/VyGvt20vl6YYdNeWYRwzEXPpjGJ6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f65953064573c45a925f00aa50545a71_JaffaCakes118

Files

f65953064573c45a925f00aa50545a71_JaffaCakes118
.exe windows:4 windows x86 arch:x86

19048ba8c514b1205a07c4a48eb505c8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

lstrcpyA
lstrcpynW
GlobalAlloc
OutputDebugStringW
lstrlenW
LockResource
CheckRemoteDebuggerPresent
lstrcpyW
EnumResourceTypesW
GlobalFree
GetCPInfo
FindClose
MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSection
GetTickCount
DeleteCriticalSection
GetACP
lstrcmpiW
GetLastError
GetModuleHandleW

user32

PostThreadMessageW
SetTimer
GetMessageW
TranslateMessage
CharUpperW
wsprintfW
GetAncestor
CharNextW
GetDC
KillTimer
DispatchMessageW
UnregisterClassA

winspool.drv

DocumentPropertiesW

Sections

.text
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.isete
Size: 1024B - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ