17fd765e79083e4c9558586c4d1e247b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

17fd765e79083e4c9558586c4d1e247b_JaffaCakes118
Size

590KB
MD5

17fd765e79083e4c9558586c4d1e247b
SHA1

730884b2121268ed1259c5d4af489c79868ebf74
SHA256

7c9480b4ff053d161fa956389026db7565c7f6210232d056bd083ddabf6062f6
SHA512

9d407824fc562f14fae0dba10ee3401662ce70d20bf87440e20781c17547361e755f13d2f971649f1a21d7977c655348162f34348d60e0e07d8d5be8121fabaa
SSDEEP

12288:SdH9NQjDcHbgENX3rbCbSCzDpaUBWMNvU/E4pEJVIiSf+:SdH9NQjDcsENX3rYSCRzBD1V2+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17fd765e79083e4c9558586c4d1e247b_JaffaCakes118

Files

17fd765e79083e4c9558586c4d1e247b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\DEV KODIO\C#\WinForms\Projects\Installers\Showcase - CARRIERS\Frostwire - NEW\Frostwire\obj\Release\Frostwire.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 460KB - Virtual size: 460KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ