JaffaCakes118_5830063d2f8f8ca53f04b45faadfc6d8 | Triage

Sharing

General

Target

JaffaCakes118_5830063d2f8f8ca53f04b45faadfc6d8
Size

277KB
MD5

5830063d2f8f8ca53f04b45faadfc6d8
SHA1

65f07822c24d08760d5e38735ef239dfae9fc09a
SHA256

143ca816d8312d18bdd9a7d45426ac36990603ea37f1c0d60eb1e9d64579ab2d
SHA512

3973bf2e8cc60bc280d5cc6f35eea4f19df05acdebdc74a5a9f91d28b7c67f68c16cecf0efd9865ed2c5c8cf204ae08a1778cc46f708fc6461e33502668f32ed
SSDEEP

6144:CKfkZ0Ou1rUFSef3qqM1Ki9D7XCrgnwjqb//FKTAD:rfSwUQe/qqdi9fygF/tK0D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_5830063d2f8f8ca53f04b45faadfc6d8

Files

JaffaCakes118_5830063d2f8f8ca53f04b45faadfc6d8
.exe windows:4 windows x86 arch:x86

65988dbc56256fa8c86af1402757aaf1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

comdlg32

ChooseFontA
GetOpenFileNameA

setupapi

CM_Get_Depth
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status

ole32

CLSIDFromString
CoTaskMemFree
CoCreateInstance
StgCreateDocfile

kernel32

SetEndOfFile
GlobalAddAtomA
HeapAlloc
GetCurrentProcess
RtlUnwind
GetOEMCP
ReadFile
WriteFile
GetSystemInfo
EnumResourceNamesW
VirtualQuery
SetFilePointer
GetVolumeInformationA
HeapFree
FlushFileBuffers
ExitProcess
VirtualProtect
FindAtomW

Sections

.text
Size: 136KB - Virtual size: 268KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ