c8b91afdb8bc92bb90275482abc204ae_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c8b91afdb8bc92bb90275482abc204ae_JaffaCakes118
Size

558KB
MD5

c8b91afdb8bc92bb90275482abc204ae
SHA1

46ff141659d9be792834a710e1783dbf42cbe619
SHA256

73a4582e886d97cafcc9c29db6c3997a4dc5cd35e53c88abd229f01d857aecd8
SHA512

01d42224569fbd2364be389ce31c06aac905b03e206b7efc36c1751b0aea38025f0b8a1d51bd9010364f60736e57f4e75e8cbc2742070a32e83c90de668df43a
SSDEEP

12288:tfyog7zYF5BINKtDFjBGT8yuzBh/CEYKPn0LK7RgbohqTGB:NMIlaKtDFjfzf/h0ONgUhv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c8b91afdb8bc92bb90275482abc204ae_JaffaCakes118

Files

c8b91afdb8bc92bb90275482abc204ae_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Documents and Settings\1337\Bureau\ownz 1.6 src\1.8.1\bb1\bb1\obj\Release\Winlogon.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 516KB - Virtual size: 516KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ