dee037be51692bb31415a6550bdb45e3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dee037be51692bb31415a6550bdb45e3_JaffaCakes118
Size

20KB
MD5

dee037be51692bb31415a6550bdb45e3
SHA1

be40adcd514fe7d12634b6467193dda58b3082b9
SHA256

d1b7f475829e65347e2679727c5f60ce7c3eece0184909f5439019a25cbd1202
SHA512

2a2e100ebc92d16bbc384ee322c89b645abffb8c14e23306080c6f2e73142ff3f563422b251b9dbd75be3ded5217eee0ddf4a824ffa5197292ffabbfcd498d3d
SSDEEP

384:R3rQ3eBfvnyXte4RI4MvLaZcI0j4+JXsFzWCUdWZ3TYchd:RrQdY4RKtsGQYchd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dee037be51692bb31415a6550bdb45e3_JaffaCakes118

Files

dee037be51692bb31415a6550bdb45e3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Documents and Settings\Roberto\documenti\visual studio 2010\Projects\WindowsApplication3\WindowsApplication3\obj\x86\Release\svchost.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ