c7b71712ac4c1ed2d0e8280adaac3d65_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c7b71712ac4c1ed2d0e8280adaac3d65_JaffaCakes118
Size

229KB
MD5

c7b71712ac4c1ed2d0e8280adaac3d65
SHA1

24dc27657dcff889f189849be5c3729da9bd5ac6
SHA256

c64d633f3907b3934d313fb6d64912a444fd99dcef239f1419d997e841679964
SHA512

ba586d3d996ef4ebdc3b89f9b5a6e4b5b312ffbd8308e52918a1ba4525413ed68f91603157af695280872b33b274908b9e9282a31ba1207d2c946deac55c4a47
SSDEEP

6144:r3BQRARGmXsh5OybtCxyq65PE8AsQcb9xw:r3KsRshHC6JERs7w

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c7b71712ac4c1ed2d0e8280adaac3d65_JaffaCakes118

Files

c7b71712ac4c1ed2d0e8280adaac3d65_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\BUILD_~1\jdk6_18\control\build\WINDOW~1\tmp\deploy\jqs\jqsnotify\jqsnotify.pdb

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.zwt
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE