52ef5989cfcfcd78ab2533961a72947c_JaffaCakes118 | Triage

Sharing

General

Target

52ef5989cfcfcd78ab2533961a72947c_JaffaCakes118
Size

571KB
MD5

52ef5989cfcfcd78ab2533961a72947c
SHA1

b631d12db5f4a83f2a02a4c9f430d5688991f8fe
SHA256

d5f3634723de411f864b8b84fe112a1c154bea2ad9bcd6e0fe2d589813f8074b
SHA512

685da300af7b7608cf76b53a198410f481b4f046a213a5cadf1bef9a769bdf27e1ed2f71c9351fd155034a4f5eba60a116344dd3af8215f7972790ec3a0c186a
SSDEEP

12288:M0wwSVFQgjvTaCLrdSG1XeUkdZcPQoEimKI8fBjrNYJal9:GFQgjbVr1kdZR/N6jhoal9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
52ef5989cfcfcd78ab2533961a72947c_JaffaCakes118

Files

52ef5989cfcfcd78ab2533961a72947c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Adrian\Documents\Visual Studio 11\Projects\DataProtector\stub2\Project2\obj\Release\iYozUEH.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 157B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 531KB - Virtual size: 531KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ