13f1f0ee5ff3ae5aed34998cea5045f9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

13f1f0ee5ff3ae5aed34998cea5045f9_JaffaCakes118
Size

67KB
MD5

13f1f0ee5ff3ae5aed34998cea5045f9
SHA1

d9a193d772f0069c6332a8cb180d5bb6740b7467
SHA256

15b549b62f1f1eda3871a0c3993df3422d312b5bb1f38621b5406bc106d9c76e
SHA512

8a2fcf2fcb382c865c84b829b5b5137a3d6b9cfc41a91dab03a1905cbf3c6a744f62250914e3c19bda5c44f2f349aaa77443d7b278e3f485839484c729f1c235
SSDEEP

1536:lYKt97gXLnhGxLnh0lHPDS6ONi76jcU9g8Zoj:VjY+gS6f6RJZk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/PO.exe

Files

13f1f0ee5ff3ae5aed34998cea5045f9_JaffaCakes118
.rar
PO.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 288KB - Virtual size: 287KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ