JaffaCakes118_99a841432b22ac1af0ea0d77454fa7f6 | Triage

Sharing

General

Target

JaffaCakes118_99a841432b22ac1af0ea0d77454fa7f6
Size

169KB
MD5

99a841432b22ac1af0ea0d77454fa7f6
SHA1

c5aa8cadaa83f71b214231a521580c8c0883c4a0
SHA256

a7e8a020f033172279c5febafa95cbf7534ab4410ece9e4d361c7b4de6134590
SHA512

74c460a47e7c666013c0dbfa0a6ff6ef9173a4a7a9935f70775da37e0e97659d34590270896390d4458035d48a21eec67c7c347892207a580742e57d691e64ec
SSDEEP

3072:R7x+w0QB9eePACXeAd90OFgeHWJmCzyYTxtur791cMkrezy:R7MQPDX70OFg/yY9QjkC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_99a841432b22ac1af0ea0d77454fa7f6

Files

JaffaCakes118_99a841432b22ac1af0ea0d77454fa7f6
.exe windows:4 windows x86 arch:x86

7e03c8c7615c5f1ac5e76e2f790fbf08

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalAddAtomA
VirtualQuery
ExitProcess
SetFilePointer
HeapAlloc
WriteFile
SetEndOfFile
FlushFileBuffers
RtlUnwind
EnumResourceNamesW
VirtualProtect
GetLongPathNameA
ReadFile
GetCurrentProcess
HeapFree
GetSystemInfo
GetOEMCP
FindAtomW

ole32

CoCreateInstance
CLSIDFromString
CoTaskMemFree
StgCreateDocfile

setupapi

CM_Get_Depth
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

comdlg32

ChooseFontA
GetOpenFileNameA

Sections

.text
Size: 90KB - Virtual size: 490KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ