JaffaCakes118_43e7bf459bafb6cb780179fc4805dbeb | Triage

Sharing

General

Target

JaffaCakes118_43e7bf459bafb6cb780179fc4805dbeb
Size

277KB
MD5

43e7bf459bafb6cb780179fc4805dbeb
SHA1

25d4557bfa35cf55f46a00f92402383c85f73041
SHA256

29a79291c0c143f3cc1e23e12c20164f46a75d512b812e7300c41261f34bef22
SHA512

33c99854b59aee6ae8c946cd65fdc166ba038d54c721ec17861b5c662152148c0d5bf6c2153ae569329da303118ec5cd6bbb734242027d149447a5ddea28ed56
SSDEEP

6144:Axc5ezASgBb6xcI7npSyE8208W1Sts0h7SFIA8Cs5ItZ5byfz51QcDdby:Yg8fnsyL2tCSmy7SFhbsSDufz5zQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_43e7bf459bafb6cb780179fc4805dbeb

Files

JaffaCakes118_43e7bf459bafb6cb780179fc4805dbeb
.exe windows:4 windows x86 arch:x86

857e0256327e8efed42959ab087fc88f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindClose
GlobalAddAtomA
FreeLibrary
LoadLibraryExW
GetCurrentThreadId
InterlockedExchange
GetTickCount
Sleep
ExitProcess
InterlockedCompareExchange
EnumResourceNamesW
GetLongPathNameA
RtlUnwind
QueryPerformanceCounter
GetStartupInfoA
SetUnhandledExceptionFilter
GetProcAddress

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

comdlg32

ChooseFontA
GetOpenFileNameA

ole32

CoTaskMemFree
CLSIDFromString
CoCreateInstance
StgCreateDocfile

setupapi

CM_Get_Depth
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status

Sections

.text
Size: 141KB - Virtual size: 273KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 133KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ