06e185b801f7fdd2657b7ad449cdb388_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

06e185b801f7fdd2657b7ad449cdb388_JaffaCakes118
Size

579KB
MD5

06e185b801f7fdd2657b7ad449cdb388
SHA1

ce459142da7d6d71fd386879d140b8fd2be90793
SHA256

15df81652c38c1cc606687544e5573e7b755bb4854cbe1f0046cad1947ed2827
SHA512

d5767ff3500094258c81189c01693b04881210bc1bf129cb13efef4b34324cf6fe7d58ee7ffcb2a3482ea68dbb518e48aa294dde32728b5efedb36a3735a5d93
SSDEEP

12288:sDVxalpN3MaCj0x+ON6QesWIqY4cFzzuhGL:sDVxopdr+fQkMuGL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
06e185b801f7fdd2657b7ad449cdb388_JaffaCakes118

Files

06e185b801f7fdd2657b7ad449cdb388_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\build\source\rpbgrecorder\rel32\RecordingManager.pdb

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 304KB - Virtual size: 304KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qnk
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE