a2a82589d3c629e29e0840add0cb7c35_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a2a82589d3c629e29e0840add0cb7c35_JaffaCakes118
Size

2.0MB
MD5

a2a82589d3c629e29e0840add0cb7c35
SHA1

ddf25a64381751c0c4e7656736be43cfdddb02cf
SHA256

317d70f04128cd08b2b01e1441414f9bfe3e455a04cd127ad4f8d10432c81055
SHA512

9583e8be703333e90fd7175e2dd0cbe137a31995a49a3328ae064a3691df19437ae625ca6208e9e7f2d3af9a9b005830a4e96d382c05bde7a30f60cfe7222138
SSDEEP

24576:Dc+lPYnAqmT8x7XdCGSo7n2xlM9ZyCmyVmMJSI8LUlFl5FpI59FF96X0JxQJ:DIn1d3So72nMbzxcY/yA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a2a82589d3c629e29e0840add0cb7c35_JaffaCakes118

Files

a2a82589d3c629e29e0840add0cb7c35_JaffaCakes118
.exe windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

F:\Office\Target\x64\ship\postc2r\x-none\msoxmled.pdb

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.c2r
Size: 512B - Virtual size: 296B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 165KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ