e9e4705d6ed3634f95ba0248e75bd100_JaffaCakes118 | Triage

Sharing

General

Target

e9e4705d6ed3634f95ba0248e75bd100_JaffaCakes118
Size

538KB
MD5

e9e4705d6ed3634f95ba0248e75bd100
SHA1

2fdfd3d93bc2520889d325b4f6c3d1446dddbced
SHA256

5e06cfdae3df0bf05ac56608f61dad3a054b4b47f10c9bc39bbe62a00ddc6dcd
SHA512

fb9586b3acf8acbfa5cf96fccebc815e1fc9ad06a8738005228dddd138ce70cb0edf424487ff7db1241aae666026b77fc2deba628040e082d3240eab33b3cc42
SSDEEP

12288:CjWkTLlCYQEetEuYFQX/N46ziZQqpwgrOmvfvx9O8IZ7:0LlCYCtEuYFizW/wwdx9Ol9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e9e4705d6ed3634f95ba0248e75bd100_JaffaCakes118

Files

e9e4705d6ed3634f95ba0248e75bd100_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\YouwoBox\trunk\bin\Win32\Release\build\YouWoBox\youwo_07291518.pdb

Sections

.text
Size: 445KB - Virtual size: 444KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9.1MB - Virtual size: 9.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ