14afafe85d20590fe0410952bb1ec5d1_JaffaCakes118 | Triage

Sharing

General

Target

14afafe85d20590fe0410952bb1ec5d1_JaffaCakes118
Size

436KB
MD5

14afafe85d20590fe0410952bb1ec5d1
SHA1

d6054e658e465d877d00c5e02039917775bea039
SHA256

74bcae8240f2b44360e3a218a428a0fa6bb2c03037d0f95ef779fcd537a1c212
SHA512

146526ca8a35dbbe1c1d74aa2ec639e55a1427501db8e1f6d2ceb2e0635123e7d9ff2eeef866e3c728793a0ec28c02a8cd7d61a1859f0c1be9f63fcfe102143e
SSDEEP

12288:ZWl3o3IH5HIFwDquCgKB3PvMPxYJFk8T2m:ZWlY3axIFwrX6XuxY9TX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/eko.exe

Files

14afafe85d20590fe0410952bb1ec5d1_JaffaCakes118
.zip
eko.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 659KB - Virtual size: 659KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 513KB - Virtual size: 513KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
favs.eko