bad6236ecc86642190a30d48b283c0e0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bad6236ecc86642190a30d48b283c0e0_JaffaCakes118
Size

580KB
MD5

bad6236ecc86642190a30d48b283c0e0
SHA1

0aa2a884ea8e6ca2fd07c43dfb504732b16cc6a7
SHA256

50374eeb48e86d2b4b673b60fd621c4eea44868c7246e3e5dfb455b06fc748a2
SHA512

db02bed74c7f019ebb41087fdb4f1825d1b04d8695ee83dd29de4f265e3113fe5d597655e0e58ecbe13dee42416331b484c8da236c0d17f21f3bfed8d4d0a8ee
SSDEEP

12288:rB5GJjCkYUYKaVjX5ILODW+crkNixBjDVRe7U51UYL2uW:zGGz2+WBoGvlW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bad6236ecc86642190a30d48b283c0e0_JaffaCakes118

Files

bad6236ecc86642190a30d48b283c0e0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Unknown\AppData\Roaming\Microsoft\Windows\Templates\yàµÉM5éªÙ.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 564KB - Virtual size: 561KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 4KB - Virtual size: 133B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ