6ab83ae5a89a3a22e88db9641a681d38_JaffaCakes118 | Triage

Sharing

General

Target

6ab83ae5a89a3a22e88db9641a681d38_JaffaCakes118
Size

16.7MB
MD5

6ab83ae5a89a3a22e88db9641a681d38
SHA1

3c5678663a4370731713feb2ae21afcfe2ccf51c
SHA256

081732a5b0ed79814cac799b08ae472fc3906b62dcd2b599c1f5d892bc2f978c
SHA512

3bdf7a3ed5887b6008043806d6f05930d89f7357dd3091d9f153f41711e1aa28e9c5dcaaa97833a66650ff4ad580df4b5a26a6217bdde11c1f73ca9eb076e92f
SSDEEP

393216:8obS++ecnf4iKnWy7bok7BIMUt4Gv8Vz+CjPnH6kxXqbp+E9c+1BUF3t3IR0y5Q:HbS+avWbo2O4k8N/jvHs+E91U3R

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6ab83ae5a89a3a22e88db9641a681d38_JaffaCakes118

NSIS installer 2 IoCs

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

6ab83ae5a89a3a22e88db9641a681d38_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.uro
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE