48aee32803a85bee4bc764a4fdec6e0d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

48aee32803a85bee4bc764a4fdec6e0d_JaffaCakes118
Size

619KB
MD5

48aee32803a85bee4bc764a4fdec6e0d
SHA1

bb8940d0401c3faf29b5fc204203f93607ad5f61
SHA256

143922bc4e9cc86d74ab6c0f391f55452afe456eae246fed5bfd9fcdd58b8a22
SHA512

fa7049a3c947d83d9c36d0258134773fcd9633e76885a283781227e802b4e15f195770e910b3cd45ede1f22e1c45013bf8a894dc7916c45e91ca7f0e3a52e513
SSDEEP

12288:lVOOGD3V0yVqjiHz11KaBIqqHXGP4kbe/+5+6r:TC0vE1nIHWP/eyr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
48aee32803a85bee4bc764a4fdec6e0d_JaffaCakes118

Files

48aee32803a85bee4bc764a4fdec6e0d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\QShuru\release_line\client\Release\QQPYCloud.pdb

Sections

.text
Size: 303KB - Virtual size: 302KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 10KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.xur
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE