3e28becd7a2d891264fb15bcfe7089e3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3e28becd7a2d891264fb15bcfe7089e3_JaffaCakes118
Size

557KB
MD5

3e28becd7a2d891264fb15bcfe7089e3
SHA1

2b19189b39599585e0f3fdd7750ca72e26e48b30
SHA256

245a7a2096eb008b7f7caf6a66755c3ec4cd79af5d2649a8d0f9d6ccae0166e3
SHA512

bdc431d481eab363de47a1dcbbff4b8d452ea1ce532f8a1a27e7725c33868294b9e272e6eedee37e56615d8e1b548ad7b78cc2aafd036da20f89013307a6e196
SSDEEP

12288:IQ0ckseWKcaYTpEUooULV5MBtauAAyg6OK59JCc2pWS59j:xJks5jpioULD+auAAyg6O6Jr2pWM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e28becd7a2d891264fb15bcfe7089e3_JaffaCakes118

Files

3e28becd7a2d891264fb15bcfe7089e3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\KINGSOFT_DUBA\Build\Build_Src\kcloud\kcloud\src\product\win32\kdumprepn.pdb

Sections

.text
Size: 300KB - Virtual size: 297KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xur
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE