59a8db9e8d0b29a3777757a5aa2982c6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

59a8db9e8d0b29a3777757a5aa2982c6_JaffaCakes118
Size

319KB
MD5

59a8db9e8d0b29a3777757a5aa2982c6
SHA1

844200223affde8fcfa8e770f04191f84464057f
SHA256

a0dc2dd6f234af8688d87c37b6f737cf432eff00ac43e07f78ad427f1d66e4b0
SHA512

c859bcf8846479933da9235cc3971c912187c12d68f43aaf6670a41b2aa837c45feb3f98eb29f19f957c1c96a68b53658edf7eaf50f39b866316bf8c992ee821
SSDEEP

6144:nPY1jgJhkSyJSLnpN0+x6B//FtQAjCdwhDHGxZSnsU+7BNRduFQ2u:nPY1jCGsVzxMd+Ir4iaBNRdyQ2u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
59a8db9e8d0b29a3777757a5aa2982c6_JaffaCakes118

Files

59a8db9e8d0b29a3777757a5aa2982c6_JaffaCakes118
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

ehRec.pdb

Exports

Exports

PerformCRLDownloadProxy
QueryUser
ehRecLock
ehRecUnLock

Sections

.text
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.lif
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE