12fcda56ee31bdf2c7672e7d5839ba20_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

12fcda56ee31bdf2c7672e7d5839ba20_JaffaCakes118
Size

693KB
MD5

12fcda56ee31bdf2c7672e7d5839ba20
SHA1

a32ca8a5ef1fe2221530559901ad2ffac1637241
SHA256

29a7b13a73ff535cc3c678e2ec24af33c9764d4d031d199f792d40e6272d9ab0
SHA512

a22cccd475f1d3b14b4de0b311a42cccfa874a6082dd5e7e86a9c7276fd930450d0a03ec62c02503ddb9c88d23c633ee113b6d4354a5b02550a71e0f12e42931
SSDEEP

12288:v/9mV5bwUdF8sFkMktj/VXNwg/3QqfS7qd:X9mV26F8dMk5Yfqfwqd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
12fcda56ee31bdf2c7672e7d5839ba20_JaffaCakes118

Files

12fcda56ee31bdf2c7672e7d5839ba20_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Gordon\Documents\Visual Studio 2010\Projects\KeyRogger1\KeyRogger1\obj\x86\Release\svchost.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 687KB - Virtual size: 686KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ