ec6ad137e19e98bb7a59d80851fc841b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ec6ad137e19e98bb7a59d80851fc841b_JaffaCakes118
Size

1.2MB
MD5

ec6ad137e19e98bb7a59d80851fc841b
SHA1

624ea4b25b9148b9daf17c54f43f8d651b80cf92
SHA256

1cbc1ab21c5b72dc06ea541885096b9df2fe6054739725addecffcdd19a0181a
SHA512

30353e122c1f7da2d6054e38e56f77bd8299ac80c74aa549ce5db3358b5c25e5996a632d8a5cf9418166f25a52b695887f56c7c5fdeb7f78b9f8b41435cc8002
SSDEEP

24576:04HOsRgiipipfGSzFQk2ROf1IegqutJQ5FeQzcuC4r6HQ:04usuEpLJ2RAR5FeA6w

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ec6ad137e19e98bb7a59d80851fc841b_JaffaCakes118

Files

ec6ad137e19e98bb7a59d80851fc841b_JaffaCakes118
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\Office\Target\x86\ship\postc2r\x-none\msosrec.pdb

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.c2r
Size: 512B - Virtual size: 480B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ