385156e81e7a30d2008bd22cd5cefd39_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

385156e81e7a30d2008bd22cd5cefd39_JaffaCakes118
Size

557KB
MD5

385156e81e7a30d2008bd22cd5cefd39
SHA1

d1f0ca4e75fa88f463e6882bad5d910a643aa695
SHA256

24768b6b89501bd04127e9293186a00d87928ccca3ecb5083eed25c5e04a5694
SHA512

1d8bd3f2c5f57acafeb1d182c2efbd36eb8c900cb14b542f7315a148b751224b859aae5f32a82c88decb760782022b71b07068da502eaa0dabfaf421cb4f6eed
SSDEEP

12288:xRWK//xAtGQlP3D/RYIDIAnHftZx3fXAOj5+puHycdPufwi:nWMJA8QFz/qIUMtrXnjnHy44

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
385156e81e7a30d2008bd22cd5cefd39_JaffaCakes118

Files

385156e81e7a30d2008bd22cd5cefd39_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

PDB Paths

c:\Users\mtk54407\Desktop\RalinkRegistryWriter\RalinkRegistryWriter\Release\RaRegistry.pdb

Sections

.text
Size: 288KB - Virtual size: 284KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.wtq
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE