844cb9e798eb7772961f43e3a6e11134_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

844cb9e798eb7772961f43e3a6e11134_JaffaCakes118
Size

596KB
MD5

844cb9e798eb7772961f43e3a6e11134
SHA1

3866c0f45c828688901120d0d9335a5195540c0d
SHA256

faa5da50d1a00554d864beb97df8482dc443a3d94437e7ef12a60226e2507b6f
SHA512

7b90bc999e5294c739960bcffb0f6d0c94128e076cbd51d2ff496fcefa8cdba38dac633a15b09ecaee08583dd197bc2b0fd4991457453613f1e6949f37920a7d
SSDEEP

12288:dpU9b5pYXaiDQn5wObpFssK3MdfpcgWexGKQjug7/UOuUwP0BKOhPRnX6:w9b43QRsspWdRq5UdRK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
844cb9e798eb7772961f43e3a6e11134_JaffaCakes118

Files

844cb9e798eb7772961f43e3a6e11134_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Roshan\Documents\Visual Studio 2010\Projects\ChrmStub4.4\ChrmStub4.4\obj\x86\Debug\ChrmStub4.4.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ