0a9638d5a4d748ddb738c956e61979af_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0a9638d5a4d748ddb738c956e61979af_JaffaCakes118
Size

118KB
MD5

0a9638d5a4d748ddb738c956e61979af
SHA1

520da3db950e7d2e1555cd98168190d7fce9fddb
SHA256

118b0268433197ce8184edea96f2bfc7a57de9217624e37fe1c5130fa3a90369
SHA512

a817441a4615e8ded5f84368799f1ad14abd6f4c146f3a881ae8a0658175d41eccf14c06779987256263eb504bc14505b2a680ac2e30062a2623eb6152661f7b
SSDEEP

3072:l2kVK9reY9vQqNYVOb8jYmccualqhGM79Qw3:UkAhJrRbAYmccualqhGM79Qw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a9638d5a4d748ddb738c956e61979af_JaffaCakes118

Files

0a9638d5a4d748ddb738c956e61979af_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

VelocityV3Client.pdb

Imports

mscoree

_CorExeMain

Sections

_GmSDgQ
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ