2d1bda5b11b2540ae685e4dbe2bf2068_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2d1bda5b11b2540ae685e4dbe2bf2068_JaffaCakes118
Size

77KB
MD5

2d1bda5b11b2540ae685e4dbe2bf2068
SHA1

52c837f97d6480e9cd222a85346b949fefce0892
SHA256

63df2d80b913e035a4375ee370a3e8b95a2644908e7c78940b2ddb68054a5f2b
SHA512

32158a7b14a7ddc7659b9cb170239c23901d82febe4c30fc01f01e5deb1796afc2bd29a21ead97e32a8c278a6d182a5c884e7a1b77da22dd1de3cef3b51a1a73
SSDEEP

1536:gJaOuzwA0GB7Gq3shvm6vT64DSmSb9Q+iuIyfrD:gJm9E6ie6vTVDQ9Q+iuISrD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2d1bda5b11b2540ae685e4dbe2bf2068_JaffaCakes118

Files

2d1bda5b11b2540ae685e4dbe2bf2068_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

I:\Personal\LiveSnoop\TendNet Agent\TendNet Agent\obj\x86\Release\csrss.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ