06870636751aa6cdfedceaf6312732e9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

06870636751aa6cdfedceaf6312732e9_JaffaCakes118
Size

630KB
MD5

06870636751aa6cdfedceaf6312732e9
SHA1

91821bed11c3ca7672786c13ee15bea7ee0cc6ab
SHA256

eb1024f8452eeb8afff90edb68edebee747f639ad2316077c0aa4aeeb842f9ea
SHA512

8eacec020220eac48442869c93128ed401d0fc11fd372682f932eaec1f5c5b5ca94bb493de500670d238c3dab729e50bfbf1b71e27dbdaf5e5fdb864c6db142b
SSDEEP

6144:DNuJnmcU2PE9hM9eXz5eUL5VZuwSxwriNokpBzuvBUcGoYMe8S/zFg6pfr0p7qi:D1cU9IeXVeUlVMH+kpZt0YMeV7PpYB/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
06870636751aa6cdfedceaf6312732e9_JaffaCakes118

Files

06870636751aa6cdfedceaf6312732e9_JaffaCakes118
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\bt\983741\target\retail\wink\i386\InstallManager.pdb

Sections

.text
Size: 205KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 7KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 223KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.jgd
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE