ebaa0a77dbea4c3d91f5919294e9ab7f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ebaa0a77dbea4c3d91f5919294e9ab7f_JaffaCakes118
Size

2.8MB
MD5

ebaa0a77dbea4c3d91f5919294e9ab7f
SHA1

c7b2556699ade139b3453a9b19da0aa107306259
SHA256

4c8d3311ab97be360a9fe62fca0aedb7f9f0c6c3467486966581d4e68f55cd48
SHA512

4e99f165629897bef6c24435c343bc0c9b122deabfee2ee299e4196ec25772afec9e20a3f271b0b3c972ee85a97a8ff998c8db971537c6c22475397a1faf4a77
SSDEEP

49152:xSEhktY1S1G/3Tbi1ksS6o7+AjNz++waapQf+pizOq7oH88MYYjSk0yh16:x4jG/36eF7Vz++w/e7o8IPH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/fo-w7050.exe

Files

ebaa0a77dbea4c3d91f5919294e9ab7f_JaffaCakes118
.rar
fo-w7050.exe
.exe windows:1 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
新云软件.url
.url