b0c3d26466f5a5bf2216402cdf0f7c85_JaffaCakes118 | Triage

Sharing

General

Target

b0c3d26466f5a5bf2216402cdf0f7c85_JaffaCakes118
Size

422KB
MD5

b0c3d26466f5a5bf2216402cdf0f7c85
SHA1

c01d4b6bb07b95a0a63b7af1e45af213b3ac3f5b
SHA256

23903bdf6ee51de7d00487c3525e3c3d6ae8a8dca3b124717c4b535e541cc6b0
SHA512

ccef9de8a68d8e09eda82003ff39fee4a02275e1298784351cc4809714c873d218a908871c56246565df5e39d7866edc71f92c412c9662d9eafc7a53a24f8f2c
SSDEEP

6144:dsyONZF2GMupeRw22tXjJg4oeMosnqD1ijXdwqFa3VM3OZCy38Iffy6ac48Ks:zONZ5in2/otaitwxsOPZfa6H5v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b0c3d26466f5a5bf2216402cdf0f7c85_JaffaCakes118

Files

b0c3d26466f5a5bf2216402cdf0f7c85_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Documents and Settings\user\My Documents\Visual Studio 2008\Projects\nufcrule cryptor stub\nufcrule cryptor stub\obj\Release\stub.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 189B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ