3f5dd733ad9e29285fa970a69d6f03cd_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3f5dd733ad9e29285fa970a69d6f03cd_JaffaCakes118
Size

227KB
MD5

3f5dd733ad9e29285fa970a69d6f03cd
SHA1

a2feaecb9d9e71091888dbdad7dac4dc8fc337c8
SHA256

ae8705e7fe9949714229e18f89cce9f0936244fb699f6b56d0550419058d6955
SHA512

c39a3175833777d965fd72e964a19ac7ee44c060e59a15c8556eed958789f68e8597c76c98236f09dd6f5838b2413c17823c781c273a44e0a5fcc4693b69db74
SSDEEP

6144:2l/aJSGpKotZhxUhqDV1lxYZ/HB4CDSsO8osXr26SzeMD:MGpKShxUhEBiSB8p7EBD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/RM 注册机.exe

Files

3f5dd733ad9e29285fa970a69d6f03cd_JaffaCakes118
.rar
RM 注册机.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 427KB - Virtual size: 426KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
下载请看.bat