cd205c33f1543be4ced3b07bdc6ca7b5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cd205c33f1543be4ced3b07bdc6ca7b5_JaffaCakes118
Size

717KB
MD5

cd205c33f1543be4ced3b07bdc6ca7b5
SHA1

7beb6232fbdde6021ec6288bebfa5076be1068f8
SHA256

c9f644be61642c28f10605846a7e7c73096cc7182bbf4a693c3933560019f717
SHA512

401d41e969c4fe176a553a22a2672d1eb3692c8c43bff2844980ca0cecbc0a3333e91b35d9f3cb812a2974846a273efc05dd06fbbed31d77b869935882933600
SSDEEP

12288:rDL1DREy1mHDL1DWEy11H35DMw2n/qIjtAhj53+/Z:/L1DRt1SL1DWt11H35DMw2n/qIjtAT3G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cd205c33f1543be4ced3b07bdc6ca7b5_JaffaCakes118

Files

cd205c33f1543be4ced3b07bdc6ca7b5_JaffaCakes118
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\Office\Target\x86\ship\postc2r\x-none\wordconv.pdb

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.c2r
Size: 512B - Virtual size: 260B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ