34f3a1bd9d1839688541ac04763928fd_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

34f3a1bd9d1839688541ac04763928fd_JaffaCakes118
Size

342KB
MD5

34f3a1bd9d1839688541ac04763928fd
SHA1

2f234aca83739fa0fd7f81530476760369fed665
SHA256

9754fce7ff2f7e3b06eb6df3985b4d1cee0139e0358368cb3c17f8c5c4f2efc9
SHA512

5302cfeb3013ed5aeb993eb90e042e1ebb965e5b71b8a2d2112bb3b417b534a67850e6089686bff2ef287179d7c49fbc424765b6b86c892c84c22b3bad5f3504
SSDEEP

6144:S6WoLCwcd+scNEW+nb6jUca5+gfpUOifCtaJppYWfmhRdHoV6:S0LCj+nW3n+Yco+gunfCEAW6Rm4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
34f3a1bd9d1839688541ac04763928fd_JaffaCakes118

Files

34f3a1bd9d1839688541ac04763928fd_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\FEDERIKO\Documents\Visual Studio 2008\Projects\FedStealer Stub\FedStealer Stub\obj\Release\rundll32.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 339KB - Virtual size: 339KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 165B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 870B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ