893f25fd9e0f66252e94aa2400a51f10_JaffaCakes118 | Triage

Sharing

General

Target

893f25fd9e0f66252e94aa2400a51f10_JaffaCakes118
Size

557KB
MD5

893f25fd9e0f66252e94aa2400a51f10
SHA1

742da5502fb0b126395cba5b081b50dcde7a1060
SHA256

0e1c90c12a3513d4da270dc03a1af1d3a8c7f4907e05304a65e6ce9805757e24
SHA512

2401aa620319b9e508514bfc853c7e44ab22de1bc3a5815cfbb2eca9b9564fce1240b6e39c07a0f52f19ad45c49fb759af68aae084224a62baf42dbed6543a08
SSDEEP

6144:mbW+VBO/Bt289mCxhVjwKQEj9lz9nSKSHo3lkWqMJJl:mbkS8YSSF0T1SKmo3lkWqo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
893f25fd9e0f66252e94aa2400a51f10_JaffaCakes118

Files

893f25fd9e0f66252e94aa2400a51f10_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\perforce\szbotond_botond-32498\3am\products\lmi\G3postga-2\RA\Service\x86\LogMeIn_ldr.pdb

Sections

.text
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 296KB - Virtual size: 293KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.nkh
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE