787b313da24b7e6abfbe791f1215651f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

787b313da24b7e6abfbe791f1215651f_JaffaCakes118
Size

760KB
MD5

787b313da24b7e6abfbe791f1215651f
SHA1

baf1191cb7b8c24f6e099070e170ec6cf39bb507
SHA256

544a932f46e467f0705e6ab583bbed013c36bed6ec034cf089d88f140f609c33
SHA512

848cdd83e06229a4be58a9d102bd0fd0af1e1bae4f5ed1358ffc4d0db87457168ee1db6efa26771ed259969481dac9ad456f437bba3c861df93c0f9a93b5ed0b
SSDEEP

12288:NhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aCy6SKW+:bRmJkcoQricOIQxiZY1iaCR

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
787b313da24b7e6abfbe791f1215651f_JaffaCakes118

Files

787b313da24b7e6abfbe791f1215651f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Razor\Desktop\VB-RAT\VB-RAT-Client\Razor\obj\Debug\Driver Machine.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 744KB - Virtual size: 743KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ