1605976c6ad6edfaef51b9eba64f39f5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1605976c6ad6edfaef51b9eba64f39f5_JaffaCakes118
Size

1002KB
MD5

1605976c6ad6edfaef51b9eba64f39f5
SHA1

586f491ef5d80e8543bd21070e874a8c098a037d
SHA256

aabbd211eace75840f5e85f3935ae15115052305da88c21b418214800d72b896
SHA512

22453e59a6f82455c6d39dc7bf2f78ec7f05f437e082febd1f423eeb65e92e59c26acd31868e3829faa5ee5d8a01ce6556548b003a8ab548ea426f6823775c06
SSDEEP

24576:zC7/wiRD8C2nS2wK028a73H1lhqUZaxVrpitvz:4l5R2Sk02R73VfaxVl+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1605976c6ad6edfaef51b9eba64f39f5_JaffaCakes118

Files

1605976c6ad6edfaef51b9eba64f39f5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Andrea\Documents\Visual Studio 11\Projects\Old\Run\Run\obj\Release\ron.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 292KB - Virtual size: 292KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ