51fe465997b9c067a1fb223719669f52_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

51fe465997b9c067a1fb223719669f52_JaffaCakes118
Size

176KB
MD5

51fe465997b9c067a1fb223719669f52
SHA1

6e9db2704fa888cabfeb0f1a743d56b92ac8e330
SHA256

78e7aad33386e103130a57a78e7737e406ccfddb18057cf2cc8c04e5c007bfa2
SHA512

b851c41a59fad07cb901563a5b853715552c89c1f6925c92d62e8e8e6d6f0ada087f740658baba272b00e2c9c99059f83bfb6e03cd7419b88568983ee97b6e1c
SSDEEP

3072:EGm4trCNUZlzY77XQrn7aRh5MEpHPtnOyiVrU0AVOQ5003osHBMAi4yCLBJpWYME:lm85zzY7DQrn74rpvS1qOOvosKcpJgYP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Trojan-Dropper.Win32.Agent.rtt

Files

51fe465997b9c067a1fb223719669f52_JaffaCakes118
.zip
Trojan-Dropper.Win32.Agent.rtt
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DelSer
ServiceMain
Setup

Sections

CODE
Size: 256KB - Virtual size: 256KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 110B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ