eb9330f52b5aa710259f1cdb32b16c81_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

eb9330f52b5aa710259f1cdb32b16c81_JaffaCakes118
Size

307KB
MD5

eb9330f52b5aa710259f1cdb32b16c81
SHA1

f8781e2c68191eab464a395b626eab076a7766f1
SHA256

418b03f19522137db140676900e847ade3c8be5edf0f3bca83afe76e835c666b
SHA512

b5c5926b80d99585bc3a3b52a9e4a44b331260079dd0a3cb1826c0992d042ad77cc8234d155d9e476e681333fcb60d9df67efd617198111f3d05e28a827cdd26
SSDEEP

3072:JnqKYG5QhJPnqKYGAQdwQt/haWBLAcOllCZkBwXTFmKXA/g5Zv3lFibpM3g0nX2q:oLdZt5FSwjDZyti19Wn8PB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eb9330f52b5aa710259f1cdb32b16c81_JaffaCakes118

Files

eb9330f52b5aa710259f1cdb32b16c81_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Documents and Settings\ALBERT\My Documents\Visual Studio 2008\Projects\NGZPSF\NGZPSF\obj\Release\NGZPSF.pdb

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 163B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.enigma1
Size: 72KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.enigma2
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE