9522b29a9f17eed87259bae035b3460c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9522b29a9f17eed87259bae035b3460c_JaffaCakes118
Size

984KB
MD5

9522b29a9f17eed87259bae035b3460c
SHA1

2eb06c7510c4c4c44d670debfba246f54bad74d3
SHA256

f3b08a14b31fed4a2dd0262bfadc2b2405de9918725507b0688d714832b88cb9
SHA512

0a9e9ed09c8dbffa92a352e45a90e93665ac034bd45c9a0c11399354ac733226a8eb4560d11c43ed7c65a9874d350cd08534388315e918d37384a3898763c302
SSDEEP

12288:3ccJmJgpsRJ2JLJnJV3BJeRJEJRkJxiq4TZJpYJlSJA:VJmJg0J2JLJnJnJeRJEJuJQJpYJ8JA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9522b29a9f17eed87259bae035b3460c_JaffaCakes118

Files

9522b29a9f17eed87259bae035b3460c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\1\s\Src\ExpressVpn.Client.Windows\Install\ExpressVpn.Client.Setup.Bootstrapper\obj\Release\WixSharp Setup.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 981KB - Virtual size: 980KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ