1c3992ed829c0b34efa3f59a3acb3039_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1c3992ed829c0b34efa3f59a3acb3039_JaffaCakes118
Size

2.4MB
MD5

1c3992ed829c0b34efa3f59a3acb3039
SHA1

eeedbac4c7f236d1e22bb17fbb91c854014318fb
SHA256

410014a9d31ced0e1be56e1c2928a8ce93e3a5f0d7b276d63b1cdfcd6879c64c
SHA512

19c402a8e9cb72717a3d4f34bd0fc7e52c3d71293539074d1e650d7575b5a2299f0f150555c71cf0767c92f2bc70cf83eaaaaeebcaa97d1d159cc18b20a7e660
SSDEEP

49152:2+rNZr59BB5uqN4tXKEQshFGdBBQIsaOwtlUAs735sTep3vTGzgwpR:p5nBnEQWoYIsaOyw3xm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1c3992ed829c0b34efa3f59a3acb3039_JaffaCakes118

Files

1c3992ed829c0b34efa3f59a3acb3039_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\coretech\source\roxy\aum\public\aum\binaries\windows\release\Adobe_Updater.pdb

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 351KB - Virtual size: 350KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 122KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 126KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 158KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.yvs
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE