2b387cb3697130bae95277561d1d52f1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2b387cb3697130bae95277561d1d52f1_JaffaCakes118
Size

2.7MB
MD5

2b387cb3697130bae95277561d1d52f1
SHA1

5a3d41e4bd819979f6a8c35379cc460ef7492883
SHA256

2094fcf426f7656967c49aa1f1166a917ffe9004c46576b9bff72a08ed7384f7
SHA512

48e109ef3c7f5990e6ce7d1db986a9e959bb2c83d21e999e5559ae2fca7768fcd129cf047e1a77f4e2a6e052ffaffdee2ecf64cdea1ab4e0b51fa87afaed449b
SSDEEP

49152:Ln0eqEkYbNwZeCIH7BTxbtkOegFb1ek4tlVvlsaWhtZfZJBhbFd2IQrZzvBA:L0fxYbNu6ZxbtkVcek4DV5WhtfJvbFsI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b387cb3697130bae95277561d1d52f1_JaffaCakes118

NSIS installer 2 IoCs

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

2b387cb3697130bae95277561d1d52f1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.spm
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE