323201c168f09aecb1483c1696493c16_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

323201c168f09aecb1483c1696493c16_JaffaCakes118
Size

587KB
MD5

323201c168f09aecb1483c1696493c16
SHA1

36dcd550f76a75b9ec2a5ec8a280ed8ca0153ebf
SHA256

987bf3d8f7448e8a71d8873c90555efe1984fb09d37bfcb0e43891001419bf86
SHA512

d7f069f12f8007dfa4c763981504e64e2581beef913b0713da1b451ad75b7dff1622052701a434f3800c6472293cf4be732eb3ad0228113e82c198c0d3072f8d
SSDEEP

12288:p3Sgyr12KpoEbC6epfE2Mt9ecg+Fjt2QBLs8Ezjy8:Nyrtq6epfO9fEzj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
323201c168f09aecb1483c1696493c16_JaffaCakes118

Files

323201c168f09aecb1483c1696493c16_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Templates\K????x5.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 585KB - Virtual size: 584KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 660B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ