eaada93483aab081123b132c9bf452af_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

eaada93483aab081123b132c9bf452af_JaffaCakes118
Size

1.9MB
MD5

eaada93483aab081123b132c9bf452af
SHA1

a22242699f4bcf0cfd065633e9aad0a13277f3ab
SHA256

1255392d4848c19b1082ca3b5528e5e7da9970f0cf089858e6b551a6c846c222
SHA512

daeead26dbf975a2fd62867e88bb105da5b7a7abf9e4a6623120eee54b4d3cc5e75ac3dd3db80d3409862f95df10161d74d2e6b8a0dbd072eec263cfbff058aa
SSDEEP

49152:MmDta43CWlIssZLi5lKr+XrGphKPgssSt2gB:MC0GUHhv7StX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eaada93483aab081123b132c9bf452af_JaffaCakes118

Files

eaada93483aab081123b132c9bf452af_JaffaCakes118
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\Office\Target\x86\ship\postc2r\x-none\selfcert.pdb

Sections

.text
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 178KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.c2r
Size: 512B - Virtual size: 340B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ