dfcd0b97398872070c0d38523033107a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dfcd0b97398872070c0d38523033107a_JaffaCakes118
Size

8.0MB
MD5

dfcd0b97398872070c0d38523033107a
SHA1

3d939fcc320fd2b2d78b3bfc6947a1c0963720b2
SHA256

367df10d41cc5f7e87b8c2b6d29923c190d4c4138988aaf7e200dc71fa9cd653
SHA512

be39b453aa5926eb79ecdedda9db604fd17ec10784ee6e1da90697e804337ceaeae2cb007fd9aef1b55a596df2552bc22f3a7fc643d70ec8647cfbe32e0654a4
SSDEEP

196608:MdZlLO3Tm/dP4AjpY8soVFj5Cb5PgaL46ijJW8m9TaR4L8pcuWfcszIX1MH:wZlLB/n9jk9P3M6ijJKM44VkaeH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dfcd0b97398872070c0d38523033107a_JaffaCakes118

NSIS installer 2 IoCs

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

dfcd0b97398872070c0d38523033107a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 56KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 166KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.heb
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE