071746f855f731eda942f1432057dd13_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

071746f855f731eda942f1432057dd13_JaffaCakes118
Size

292KB
MD5

071746f855f731eda942f1432057dd13
SHA1

70fe874d033599c1ce33d9808423283ff4c721a2
SHA256

6daf038040a9a29a2ca01dd4a3711521af7f9d78e68be5c55597de946549ecf7
SHA512

7c963f0044fa62999d59e8eb585a2a92b12ab9c4acbd61f4ea8f80f172de1cb8fa1b0483a66ad9f593913955978c1993d592cb7286bd181fee8cfb5388c1c5d5
SSDEEP

6144:cO3c5Dj3IQIEOAwkn9uKIEWh6OdQVJZJneWkq86Dh7qhAi7MkY6O+CagR:B3qFPKkWph6OdQLZJ/Bt9G9Aknk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
071746f855f731eda942f1432057dd13_JaffaCakes118

Files

071746f855f731eda942f1432057dd13_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Projects\WinRAR\uninstall\build\uninstall32\Release\uninstall.pdb

Sections

.text
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.xur
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE