5d03e7c5855a203eb979fad301d368f8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5d03e7c5855a203eb979fad301d368f8_JaffaCakes118
Size

320KB
MD5

5d03e7c5855a203eb979fad301d368f8
SHA1

70cb932879da7d8a71178cf007a944b39ab2293f
SHA256

6bb5755ba7ce047ad3876fd15acd3408a01c55f333f12f6bedaf64fd5bc02d52
SHA512

997d15239eeb1133950f44df7f3d21dc778ec09e0a3002141624c5b2df103732ff4ab6c4ec0277de1b1ff67378401402b4fad7c0a2dea813c1e5039771ee42d9
SSDEEP

6144:S4RRs16jmcOGB1UcOTMgxZF4BzyHib91jz2JM5t4XS4yTp2T:S4R+QHUc0Mgi2YPGJ/By

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5d03e7c5855a203eb979fad301d368f8_JaffaCakes118

Files

5d03e7c5855a203eb979fad301d368f8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Documents and Settings\xp_pc\Local Settings\Temp\ofdmncat.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 304KB - Virtual size: 303KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 4KB - Virtual size: 117B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ