JaffaCakes118_41e9f1f3410db5e4226b9e465582fddc | Triage

Sharing

General

Target

JaffaCakes118_41e9f1f3410db5e4226b9e465582fddc
Size

170KB
MD5

41e9f1f3410db5e4226b9e465582fddc
SHA1

9e445a5220f6a19d300f55a416c2f55ace50a5a5
SHA256

4c3ab62582c73b13152d9165653ab4e308276824ee03d484436d0c3de5295d0e
SHA512

423d741f9d9e415247146cde9cf372671c02db7a6d5a8fd96a5545e4b6aa2410579c6a397e6b47c6c747efe55b4f8823cec7186ec6405fe390413737702991e9
SSDEEP

3072:dPrNKNOnU+1V0jf4QtQq9Pphxq1/+JtmqD5sn4sNCVW3k:dPrNKNmx1V0j3NPdq1mTFYtNr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_41e9f1f3410db5e4226b9e465582fddc

Files

JaffaCakes118_41e9f1f3410db5e4226b9e465582fddc
.exe windows:4 windows x86 arch:x86

6b17302ac9b7bf226beba36a818a5a14

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FlushFileBuffers
VirtualQuery
GlobalAddAtomA
SetFilePointer
GetSystemInfo
SetEndOfFile
RtlUnwind
VirtualProtect
HeapAlloc
EnumResourceNamesW
WriteFile
GetLongPathNameA
HeapFree
ReadFile
GetOEMCP
ExitProcess
GetCurrentProcess
FindAtomW

setupapi

CM_Get_Depth
CMP_WaitNoPendingInstallEvents
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

ole32

CLSIDFromString
CoCreateInstance
CoTaskMemFree
StgCreateDocfile

comdlg32

ChooseFontA
GetOpenFileNameA

Sections

.text
Size: 93KB - Virtual size: 489KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ