ddae8166ea999f5c90285c7cc4939e4d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ddae8166ea999f5c90285c7cc4939e4d_JaffaCakes118
Size

1004KB
MD5

ddae8166ea999f5c90285c7cc4939e4d
SHA1

cf4422120bea5f36443be26091c6a86e5faef30c
SHA256

46dd4471ff88c38b40ab0fbfbced9fdc1e9d353d2a1c0340611174cc7f372884
SHA512

f52b284b5a3db6106938b37f99887ff06aedd1a04d306f972b416317799bd0c541cbc07673a4913058d669c19dea6bf7b9202fc75812d9386c11dd3ef21616e1
SSDEEP

24576:7lSa1IRwoR5+t0pOdR07CWlTJissd7pB4qBLi5lKG6++:Y42KeODsCWlIssZLi5lKr++

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ddae8166ea999f5c90285c7cc4939e4d_JaffaCakes118

Files

ddae8166ea999f5c90285c7cc4939e4d_JaffaCakes118
.dll windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\dd\vsproject\xmake\XMakeCommandLine\objr\i386\MSBuild.pdb

Sections

.text
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.extrel
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dbgmap
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.il
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ