210b620755c70aa2bb50bed0215548a8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

210b620755c70aa2bb50bed0215548a8_JaffaCakes118
Size

1.6MB
MD5

210b620755c70aa2bb50bed0215548a8
SHA1

58a76a3d3600d55b1fcd999cb0167f62b644deca
SHA256

4ceeaad022776ab28368233df44ab2e7f5928a2dcc639af5fa2acc46eb5280b0
SHA512

d4d668b358604ed6c73f5a67a6ab60ecbef9dd5ee9f3479ef7255375a4e267a63e0feae9b530c8457016551c40c976c244f79d6333118e8657ff9527ba6657a6
SSDEEP

24576:FVRrtVRrLerm4dZhFlXB5e7eim8yOgu6PrZKSL5cvlv:FVBtVBKrl3B5zOlSLIv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
210b620755c70aa2bb50bed0215548a8_JaffaCakes118

Files

210b620755c70aa2bb50bed0215548a8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Meir\Documents\Visual Studio 2008\Projects\Stub\Stub\obj\Release\HijackThis.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 380KB - Virtual size: 379KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 141B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 364KB - Virtual size: 364KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ