1407576be34df579263b2e7dac96da20_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1407576be34df579263b2e7dac96da20_JaffaCakes118
Size

8KB
MD5

1407576be34df579263b2e7dac96da20
SHA1

e7318f485bbcc5703eff4d78289c8c56ef258593
SHA256

1c73f7595513fa527491821c535c04476d651fc093d30e3611afd69803bfd2de
SHA512

a2c807cd2ff86d08f15d8ee578cf3a8e941bc9a44dc2d402eb08f22e137c0d5dc1481fcec732085966f67830aaf8e9d1125d30d6fa90783d3a790ce1a7209d8e
SSDEEP

192:YPsN/FSUAu5eI994bWEYde8u67wGQAtvMF:R9SUJ5eq9kWZd0MQAtvM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1407576be34df579263b2e7dac96da20_JaffaCakes118

Files

1407576be34df579263b2e7dac96da20_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Users\jmutz\Documents\Visual Studio 2012\Projects\WinProcessHelper\WinProcessHelper\obj\Release\WinProcessHelper.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ