137b6ba6639459db4deadb709046dddd_JaffaCakes118 | Triage

Sharing

General

Target

137b6ba6639459db4deadb709046dddd_JaffaCakes118
Size

526KB
MD5

137b6ba6639459db4deadb709046dddd
SHA1

9b7c0ea5de4684f37fdf8783b74ba33b74a9cbc3
SHA256

8824c0c60a5dbf38b0f4ccd3d910431011f0807c8cb7d9ab2010014dd82cd46a
SHA512

514d25c00b9048a3495b4474ed9d88c35317006b7ea78bf54c7d17fb148b3b6188e3898ff031e0d09f0b665a72c77a1f6ce4717ebd723b5249fddb0092ca241b
SSDEEP

6144:3zf3PVa69YaKrUjEvhBvV8RUNKBP3npj4/0hvyiJuIJ+lPYR:3zfday0rUju8bP3nCeqi8C+lPY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
137b6ba6639459db4deadb709046dddd_JaffaCakes118

Files

137b6ba6639459db4deadb709046dddd_JaffaCakes118
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\Office\Target\x86\ship\postc2r\x-none\olicenseheartbeat.pdb

Sections

.text
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.c2r
Size: 512B - Virtual size: 380B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ