f66d4e512b1673f753c3483b167ad207_JaffaCakes118 | Triage

Sharing

General

Target

f66d4e512b1673f753c3483b167ad207_JaffaCakes118
Size

619KB
MD5

f66d4e512b1673f753c3483b167ad207
SHA1

2758f10c1bef4ae5ddeea6a86b9fbef0f13f6ed3
SHA256

1d6daada348ccc1aa1b8695f1126756e0f8b004a5363c4f502f1fe853264192f
SHA512

f276cdedb8f815b0a1f1c9ff20d42e52c6412f8c6f9b734c5b41165b52d5a3fba71f959a30213c5d7835549a944051b0d760a23a59a01b1b3328ae379fa1a179
SSDEEP

12288:psUU/Ycw34wNsZwWP5a+Fc/h5hZrycpRKzvpbzANxxVi:lIwNsLOpx/RKzu3v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f66d4e512b1673f753c3483b167ad207_JaffaCakes118

Files

f66d4e512b1673f753c3483b167ad207_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Slichice\Hakovanje\[2010] Hakovanje\DeskTop\VB.net\Projects\CR-Crypter\CR.Stub\obj\x86\Release\CR.Stub.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 162B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 576KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ