f7c698eab71c220e1a698b32727534d2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f7c698eab71c220e1a698b32727534d2_JaffaCakes118
Size

686KB
MD5

f7c698eab71c220e1a698b32727534d2
SHA1

42e7e215dedc10c21862653015e1292c1c01d0f2
SHA256

509d77d4af8babe41e4c605a3fe4f8f24ff86c987ec95f3ca1916e525356c3e6
SHA512

6146e1bfcf0fc9d2aafc7f939f0210fdb9faf3b771f856e617edb08d0097c8c311882a94b389df56176dd73802cdebfd9d3898b89a035ee0b67b02b077bb111f
SSDEEP

12288:bGcRKryoBsEb+sk7sufTxtjhC0UkZlzoOaqFgGrctPMmYwU0:WryoBsEbZKlCrkZaOaQgltE2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f7c698eab71c220e1a698b32727534d2_JaffaCakes118

Files

f7c698eab71c220e1a698b32727534d2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\SlowSteady\Desktop\NetherStealer\NetherStealer Server\obj\x86\Release\Dupy.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 493KB - Virtual size: 492KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ