648e1bcf0faf2ffb225a94f5f0b247fa_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

648e1bcf0faf2ffb225a94f5f0b247fa_JaffaCakes118
Size

3.9MB
MD5

648e1bcf0faf2ffb225a94f5f0b247fa
SHA1

1905f8d62ca71d09c81f806fd9c6ff59bd62dffe
SHA256

2ea84401a887641cfd6ca150456520ad65a874f2f5d1cb54bbd99b97d4f7b7a1
SHA512

4711a29a1cf5e2bd024840ba51e588ea4ef508d18d3dda031d203e013ec71497a3fa1a3763685b2e4dfd1d5df4e615bf55ee5b7e5c8660782f0551d726b850df
SSDEEP

98304:23AeyOu6AlFjtSyOldWfCsfkjhr1Iw8PrCO5U:2QVD64jQyOlIavhJVOG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
648e1bcf0faf2ffb225a94f5f0b247fa_JaffaCakes118

NSIS installer 1 IoCs

resource	yara_rule
sample	nsis_installer_2

Files

648e1bcf0faf2ffb225a94f5f0b247fa_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\GABY.DESKTOP-G458OP3\Desktop\Windows Projects vb.net\Win and Office Mini KMS Activator - Final\Win and Office Mini KMS Activator\obj\Debug\Mini KMS Activator Ultimate 2.0.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ