9760090816c9f29b0ebbb39bc33c28ab_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9760090816c9f29b0ebbb39bc33c28ab_JaffaCakes118
Size

193KB
MD5

9760090816c9f29b0ebbb39bc33c28ab
SHA1

dda96165cd33e335aee53dae15be5267be11f5db
SHA256

590c1042794f470afa20c821f4d3c34ce4e427e5a297c4de9810a4ff7276fff8
SHA512

f241c0c8eeb8c031768648a8c56dc39abdf7a678fb4f72fc9a82e44b53fbc69f8cf676ff79893c3adcb087c4994d9b0ddac402ccf6a430785b75412f9764284d
SSDEEP

3072:iG5rMlaTgOidzLWvI+MgrqxNebArAntnU9cIw+cMYm0EPI:iGySidW9qTCArAtU9sMnPI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9760090816c9f29b0ebbb39bc33c28ab_JaffaCakes118

Files

9760090816c9f29b0ebbb39bc33c28ab_JaffaCakes118
.exe .vbs windows:4 windows x86 arch:x86 polyglot

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Dokumente und Einstellungen\Krusty the Clown\Eigene Dateien\Visual Studio 2008\Projects\ECLN 0.3.0\OpenSource RAT Schäding\OpenSource RAT Schäding\obj\Release\Stub.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 225B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ