ffc6450a46b12c3e9f8ef0744173894c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ffc6450a46b12c3e9f8ef0744173894c_JaffaCakes118
Size

4.9MB
MD5

ffc6450a46b12c3e9f8ef0744173894c
SHA1

a61b4d9738264aff9dfbd87d7ce9bb3020667eb7
SHA256

923894aa1c078d6082d5863551111058e1077e565c3d5ce6283dd0e6b7c29284
SHA512

bd38c38fc3dfbd6bf7b0b248e9df2864ab6386651f9dd4a46b31f2416d27279a20d18f32b27e2f196520d657da37a1e56a13a6bb074b473f4bb37839b2830b34
SSDEEP

98304:UsPj6quMBYyuSFOMKykvYgS/ylTpHufHMpPbOZ39c7T3eeom2vJtPShk:hPjzayuSgMKykQgSaTkvMxEYT3OfPShk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffc6450a46b12c3e9f8ef0744173894c_JaffaCakes118

Files

ffc6450a46b12c3e9f8ef0744173894c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

PDB Paths

sfxcab.pdb

Sections

.text
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.7MB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.heb
Size: 1KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE