270718487b847b20756ad5e6b12fa702_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

270718487b847b20756ad5e6b12fa702_JaffaCakes118
Size

580KB
MD5

270718487b847b20756ad5e6b12fa702
SHA1

9b60f8c31b31ee19ee00ad3ba3a623f01b638403
SHA256

45c601f4a0588ec0858ad17b6893255f882896533d90e1e8f3ce793690ed626f
SHA512

1a31d109f45262f3434efeede6def0dae14e1d3aa62094c1fc1683a9e8fdc26bb6b3b3fe9317aef107c54f2cc36b9ee2b88e30a01085847581ec2bcb8e2b4e0e
SSDEEP

12288:pLbmUL8OgU4igQHiVehwcELB3rECxSYOjA5ZFj7Fgh91vPfj+4vkndsAxIVR5:NMyCWREREwzO2WftXi3j

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
270718487b847b20756ad5e6b12fa702_JaffaCakes118

Files

270718487b847b20756ad5e6b12fa702_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Alin\AppData\Roaming\Microsoft\Windows\Templates\k3??????PAw.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 578KB - Virtual size: 578KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 676B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ