29a6b5d7e4088f62a6a0063d48932be7_JaffaCakes118 | Triage

Sharing

General

Target

29a6b5d7e4088f62a6a0063d48932be7_JaffaCakes118
Size

3.1MB
MD5

29a6b5d7e4088f62a6a0063d48932be7
SHA1

ab8a72e9d5aa856a3d773e504304c0d7b054730a
SHA256

56fc2ca8e3aab53299a2c2269fceb4507abeef5ab57026151a97119191f154e4
SHA512

1d4e55132950da2302d3054dfbb4e5792c99cea24f9285d47f592bc31919727268a3db923cc4e9533da5986f15ac5b756e19ec1df35a0350909570d0d6260cfb
SSDEEP

49152:lDkYOMwwnMb4PmyVpoJdXN0BMOwLloBrugS92P9VfWB:KYOXwnS4rV6JdXN0B7+skq9Fa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29a6b5d7e4088f62a6a0063d48932be7_JaffaCakes118

Files

29a6b5d7e4088f62a6a0063d48932be7_JaffaCakes118
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\Office\Target\x86\ship\postc2r\x-none\msosqm.pdb

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 892B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.c2r
Size: 512B - Virtual size: 220B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 332B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ