ff45be0222effc1232370461498d8863_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ff45be0222effc1232370461498d8863_JaffaCakes118
Size

697KB
MD5

ff45be0222effc1232370461498d8863
SHA1

5af4e76af15709221baa38e177e8a2dfd4de4d94
SHA256

4813b27174901fd49ae0ed726181439ceeda96dfaf03f5e3a4ac8c832756147d
SHA512

8d8ff346bed7dc26de2546229df371f5b7c03976d7d3bc56ad4e114bfdbe5b38d67dc07bcf97df152875f0071f08410a7608cf7ef7eef0a5ba2f2f153f3e5153
SSDEEP

12288:h4knqxpVkds94LWleE81GNlSMlTAJlR83dZCNpb8XLIXmsUzPwnRcY3rHuJnmJ:tnLds9BlSGNlSDJ03OSg4z+uJnmJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff45be0222effc1232370461498d8863_JaffaCakes118

Files

ff45be0222effc1232370461498d8863_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Documents and Settings\Administrator\Desktop\ESTv3.0\ESTv3.0\ESTv3.0\obj\Release\Rokan.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 146B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 585KB - Virtual size: 584KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ