4d9139922c0067bd05ed1eddafc7469a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4d9139922c0067bd05ed1eddafc7469a_JaffaCakes118
Size

543KB
MD5

4d9139922c0067bd05ed1eddafc7469a
SHA1

429fa1786f447950d66f5d65d7cfa6ddfc75cf16
SHA256

3350b6423f481ba675c746f841a604b18327f2b4d529cbbdf68d73dcec38e6c0
SHA512

1621f688f9d668e079dd7bf9cb8b1f1a25aea6ce33c717fef74df26bd9ac4734f17ece8f020b98b53286a5351b1d8b05f6f405ff8e7803df3a144e76e0aa9c28
SSDEEP

12288:cQ/r5AStl+jOHRk2YQN0gfqB2Se20t/KYp5UXPHu41gP51DdbMCXYC9Qeg:9z5ASf+jWRvcB21tpp5UXPHCKeg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d9139922c0067bd05ed1eddafc7469a_JaffaCakes118

Files

4d9139922c0067bd05ed1eddafc7469a_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

PDB Paths

C:\bld_area\InstallToolBox_r6.6\bin\BIN.IRU\MiniStub.pdb

Sections

.text
Size: 414KB - Virtual size: 413KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ