25a16dc3002665e6f27575e5a5d59972_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

25a16dc3002665e6f27575e5a5d59972_JaffaCakes118
Size

590KB
MD5

25a16dc3002665e6f27575e5a5d59972
SHA1

d24a85ba38a03bb0fb978f0e8a3ef89455e7abe2
SHA256

ab22dd95e69dc336f59f31b18077a89e79eb09c90dae1a8fbbdc07f6e9b97095
SHA512

c45e9c673faa1018457061ed903baa46dfe62bf97f487596e213b575fe45d966322238a6f0409fb8d72c90dc32fcaa699ca71043949428dc5dfaa8880513e179
SSDEEP

6144:aQE+Chm/np422iKx8T4dcPdm7TGeu6OW3ccDJ:aH/K4Tt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
25a16dc3002665e6f27575e5a5d59972_JaffaCakes118

Files

25a16dc3002665e6f27575e5a5d59972_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Users\Recoa\Documents\Visual Studio 2012\Projects\Gameloft\Gameloft\obj\Debug\Gameloft.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 569KB - Virtual size: 569KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ