JaffaCakes118_17f4cfcbc50ba119e2c63c0e6bf33cb4 | Triage

Sharing

General

Target

JaffaCakes118_17f4cfcbc50ba119e2c63c0e6bf33cb4
Size

279KB
MD5

17f4cfcbc50ba119e2c63c0e6bf33cb4
SHA1

dc2bd505f277dda854303b423fe49f067bf237c7
SHA256

6afffaed407eca6847115439f9e367fca55d7dd48ee9e4e59487c5f35be3b845
SHA512

67943c2c3d03f5f2e07dc32da104f64defc6b5a69ad1aebeb57abd0fb1417101d53ec578e51b916478eecba98987a141faf9dec91a5e9189ad0511c65e6b4159
SSDEEP

6144:kv2LVrzFm3ztHTVbJfHkKeJn/JpNdn9W2PxtYHUHKLifODCsZLRVA:kv2La3ztHJJfEJHNls2PxtU06BhRVA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_17f4cfcbc50ba119e2c63c0e6bf33cb4

Files

JaffaCakes118_17f4cfcbc50ba119e2c63c0e6bf33cb4
.exe windows:4 windows x86 arch:x86

f71309e12011c38f2df231874d7f901c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

kernel32

GetCurrentProcess
GlobalAddAtomW
GetOEMCP
HeapFree
SetEndOfFile
ExitProcess
RtlUnwind
SetFilePointer
EnumResourceNamesW
HeapAlloc
ReadFile
VirtualProtect
GetStringTypeExW
GetSystemInfo
VirtualQuery
WriteFile
FlushFileBuffers
FindAtomW

comdlg32

ChooseFontA
GetOpenFileNameA

setupapi

CM_Get_Depth
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status

ole32

CoTaskMemFree
CLSIDFromString
CoCreateInstance
StgCreateDocfile

Sections

.text
Size: 145KB - Virtual size: 277KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ