910e6f84392c4202a7aecec7e272ec88_JaffaCakes118 | Triage

Sharing

General

Target

910e6f84392c4202a7aecec7e272ec88_JaffaCakes118
Size

363KB
MD5

910e6f84392c4202a7aecec7e272ec88
SHA1

87d576afbc597b8bad33711adcbf09c2ffcd3006
SHA256

8df17054582dadea3ec01f53993e88ebc0c6068cd724498230889617088aba90
SHA512

e63bbee09f3e27d652edef460fc0d4813297d68de961484b47a866faafdcf18e2f95ce226554cd11b47e56247b74e4e2655d7bceb811e8d9d44f3f3bf42fc8d1
SSDEEP

6144:01j4BhZIY9fq6SmciNIIykyD16mMMycRrmGiGMWwOrmtBgjDwGVJoy2aQ2v9v+:m0kY9fEmciaIykY8zMycRrmGi92rmKDY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

unpack001/Receipt.exe

Files

910e6f84392c4202a7aecec7e272ec88_JaffaCakes118
.rar
Receipt.exe
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

t:\visiomisc\x86\ship\0\vpreview.pdb

Exports

Exports

??4XmlCharacter@@QAEAAV0@ABV0@@Z
?isAsciiDigit@XmlCharacter@@SGH_W@Z
?isHexDigit@XmlCharacter@@SGH_W@Z
?isPubidChar@XmlCharacter@@SG_N_W@Z
_GetAllocCounters@0

Sections

.text
Size: 322KB - Virtual size: 321KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 221KB - Virtual size: 221KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ