3f0d5436415d6638995a1632dc999361_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3f0d5436415d6638995a1632dc999361_JaffaCakes118
Size

12KB
MD5

3f0d5436415d6638995a1632dc999361
SHA1

a40f389e3e56d278109b4416ded5f2251f82e593
SHA256

4ca9b49a3ceb5bcd88828d2b785e6de327dfa17bef642e00439252833d3d1279
SHA512

ef2bae0b387c0841372f9faa0473317b94c27b2062e8d36bd14525593945aed26e32c89bf305db16ef77c9142e53940a52702000004556e85eec4d44815454fa
SSDEEP

192:U8R7JobaHrZrHq+gHeBy1KKqSz1NF8KdrmGfl9+5wKIW1PqFKJCBd2sLYLMrBNWE:noqZOHHeM1KKqWHnpmc9+5qFKJwjoMrO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3f0d5436415d6638995a1632dc999361_JaffaCakes118

Files

3f0d5436415d6638995a1632dc999361_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\users\slytaria\documents\visual studio 2015\Projects\HijackNoNameBot\HijackNoNameBot\obj\Release\HijackNoNameBot.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ