49806ed3a01ffe6765f0b6ba1289d97e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

49806ed3a01ffe6765f0b6ba1289d97e_JaffaCakes118
Size

6.4MB
MD5

49806ed3a01ffe6765f0b6ba1289d97e
SHA1

b14f71e125aa19f2a5e1a2de08a2738901fa2683
SHA256

fcae67041366cb88ecd36dc848a13f0a40e9ba55869c2fd3ffef6449e6d63e25
SHA512

d4768bb01818e0656270a66bd263e9e652992a63ca267de06bde957cf90752b868e614594c588b585e93b9af69d39a4f0acd3743046e99f45118de7056015f98
SSDEEP

98304:D33yKMaL/eXV1i/kDxkmcL/eXV1i/kaRWYL/eXV1i/kmeM1qj4iwiANvSo2/CAy4:byKnZrrLGA3PhsKPkG09W8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49806ed3a01ffe6765f0b6ba1289d97e_JaffaCakes118

Files

49806ed3a01ffe6765f0b6ba1289d97e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Documents and Settings\Harry Frith\My Documents\My Dropbox\srslolz\obj\Release\RemoveWAT.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 6.3MB - Virtual size: 6.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ