f2350d9da9051029168c415c56af5911_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f2350d9da9051029168c415c56af5911_JaffaCakes118
Size

2.4MB
MD5

f2350d9da9051029168c415c56af5911
SHA1

f44b37a4ad1d5826e31fc595f8656c427e18f64f
SHA256

0d1b1d62fe01a418a7252ed69d0391e65abfc18ed6cdf3d92b793379b4dc7e09
SHA512

d8ee29c3bae249d3d2ad1343cffc94edbdf6949eb6b18124f23e31e11ab7f48ff40f4524ba8f61891bfdeb893bcefa94f1f4480433167b462ee216750d23f561
SSDEEP

49152:SWHc8MNFDxzVHF+3j5D78OBUEakOElMaFLk0J:JcHCs1Eak7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f2350d9da9051029168c415c56af5911_JaffaCakes118

NSIS installer 1 IoCs

resource	yara_rule
sample	nsis_installer_2

Files

f2350d9da9051029168c415c56af5911_JaffaCakes118
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\dbs\el\oc\target\x86\ship\postc2r\x-none\setlang.pdb

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.c2r
Size: 512B - Virtual size: 300B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ