49b03e89d0c8f64115df3f51a2ed39c5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

49b03e89d0c8f64115df3f51a2ed39c5_JaffaCakes118
Size

20KB
MD5

49b03e89d0c8f64115df3f51a2ed39c5
SHA1

d5ba95521df4f1efc28736c851b80183f0431473
SHA256

ad6acb43ac327655f1d2b45213904f5fedb35650acf0fe8db707cc3efde5ed4d
SHA512

130b7c0bdf10e75517523801b6471c5e98cdf86a11d6daeb28a911a49d96a41b333f0c44f3c0099993e726fbdc27cbb1bfdf5a329bb81053788ff661d36f1050
SSDEEP

384:k/47bjl54oahEmgiIyhOuh2dgRLf45Jc+GkQ6rW/8leDHN:k/47bn4oHnRgQiFKyOkt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49b03e89d0c8f64115df3f51a2ed39c5_JaffaCakes118

Files

49b03e89d0c8f64115df3f51a2ed39c5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\Data\Visual Studio 2008\Projects\Wekker\Wekker\obj\Release\Wekker.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 125B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ