399644b9d97d2d8e5836a712151b5925_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

399644b9d97d2d8e5836a712151b5925_JaffaCakes118
Size

257KB
MD5

399644b9d97d2d8e5836a712151b5925
SHA1

eef8678a487e32dc4d2f379e56634d0ddbf604b9
SHA256

4487b97b9f601b2dc1d8ab72afc046a6f5e8376221c67228a58ad93ab2d38a31
SHA512

46234389fdddc90be86a8353a38971eaa187bfe6789a40a1a263123a8a13841dc14b5c1d5c5767a6652adc5f500aa20e1af6cc4f5fe685f721556f0b777e7411
SSDEEP

6144:sBmfTCfPo4K6eUXaAbDD4CB1bgzAH/82BAHmwtHpaGPsn:Ym7aodAt1bV1AGcJazn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Emblem_Crypter.exe

Files

399644b9d97d2d8e5836a712151b5925_JaffaCakes118
.rar
Emblem.ico
Emblem_Crypter.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Documents and Settings\kink\Local Settings\Application Data\Temporary Projects\Crypter\obj\Release\Crypter.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 284KB - Virtual size: 284KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 166B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ