4065de31f29134f9e126b736b88f4f97_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4065de31f29134f9e126b736b88f4f97_JaffaCakes118
Size

1017KB
MD5

4065de31f29134f9e126b736b88f4f97
SHA1

caca5430b7ef1ba1f3df3c55ed64a00049ee6f2b
SHA256

8c6045a4947950024337f31511003253446ecd9dfc5a8102c36fb9d8266c6b77
SHA512

0bed6324ee5bc2e18e1ca25b25e42c22ceaad10d86a7d62079d7cbda5674fb74bf7e80aa35bbfeac0058e70cb5d751457c2b3d0d70c1955ff9ae81b7cf7b8f4b
SSDEEP

24576:R0JhZZDkUusgjgU8pIuRSQILSygFWEtfPIXoOlA7+07Fgj:AVgjgU8pIuRSQIWfjtYzlA7rY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4065de31f29134f9e126b736b88f4f97_JaffaCakes118

Files

4065de31f29134f9e126b736b88f4f97_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\buildbot\release_stable_82\release_stable_82\Bin\Release\32\AAWTray.pdb

Exports

Exports

??4_Init_locks@std@@QAEAAV01@ABV01@@Z

Sections

.text
Size: 455KB - Virtual size: 455KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 9KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 177KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.pmj
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE