490e0ea8c6d9c971f1250ec46bebbc1b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

490e0ea8c6d9c971f1250ec46bebbc1b_JaffaCakes118
Size

795KB
MD5

490e0ea8c6d9c971f1250ec46bebbc1b
SHA1

6cc3350e618119ddab4f62faa7385cca432e2cfb
SHA256

604027026454fc8e0cdb420abe4cb616464c2c10876354308e3173540bc6d11b
SHA512

54a3813e3551eea2b57af0e62cb3cc6678f90f4f5a14873ad36d41fb25ab4eccd03335b93f5a018a5cbe9a09a4b51ffdb56afce98afd5e66603d444e0d528172
SSDEEP

12288:1TacwPeottjmnqdipYzYxcu7PNvz6NgJRfR3l7KevLHWlfDw9XUH1ZMbR3nK1Q:5QWkiyOjhzigJ1R3l7KMLQfE9XIEV3nx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/translation.exe

Files

490e0ea8c6d9c971f1250ec46bebbc1b_JaffaCakes118
.rar
translation.exe
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
新云软件.url
.url