fa29068f8e947fd9bcc64992ce856bb5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fa29068f8e947fd9bcc64992ce856bb5_JaffaCakes118
Size

723KB
MD5

fa29068f8e947fd9bcc64992ce856bb5
SHA1

5a401a36ce9049b01f7d9a6a0f448c98f57f71e8
SHA256

c7c7f8a55caa43e9febd3782018a67a25b8b4520f0b23271353d82093ea4da12
SHA512

e5a37a2d261dc996f4f46e370e597bca0dac9f4543db01340bbf0099f5e3fbf34c284a5fd0204c332830bee98b0e6c55f60a91fad354113771cd6d2a7dbcdc6d
SSDEEP

6144:FQ+K/MiB5yPeXWPjW2I9UTfnsk3+Mgyfm6tWa1IrOONu7g:FJK/bbyPeXW06vWa1W3s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa29068f8e947fd9bcc64992ce856bb5_JaffaCakes118

Files

fa29068f8e947fd9bcc64992ce856bb5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\dontknow\Desktop\0 30-1-2021 Exploit VB.Net 45.77.142.195\xRAT-master - Copy 30 May 2019\Client\obj\x86\Debug\msword.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 358KB - Virtual size: 358KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 363KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ