133844b1b4678aa959a33696b5fc3590_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

133844b1b4678aa959a33696b5fc3590_JaffaCakes118
Size

17KB
MD5

133844b1b4678aa959a33696b5fc3590
SHA1

e19fc3542c2d88d8bcddf569939224597a5de68a
SHA256

a6412c21316af759513ba69fc69b1bc17cc1dafc7d29763130b930436f872baf
SHA512

b0b2ac2a3e0a4b1f70c00e645cc88a14645ac5ecc632515e548afb7e81547a708a79bca65a10e9ede51911f9984f756d386f51701d840753c5f163d86dd560cc
SSDEEP

384:4Efc6oEFddYSs53xl0YK3cKEET5Lk245Na3XbOU+Y9M:4567FEd53xiYKs989e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
133844b1b4678aa959a33696b5fc3590_JaffaCakes118

Files

133844b1b4678aa959a33696b5fc3590_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Schwartz\Downloads\Kassl-dWinlock-Trial\sample-code\VB.Net\SimpleDisableKeys\obj\Debug\SimpleDisableKeys.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 170B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ