82cbad79dcc761c90cbdee3ea2d53307_JaffaCakes118 | Triage

Sharing

General

Target

82cbad79dcc761c90cbdee3ea2d53307_JaffaCakes118
Size

878KB
MD5

82cbad79dcc761c90cbdee3ea2d53307
SHA1

a5ffba7b327fbd5fb7de72f203deb8a98a82b9ee
SHA256

c66c677555ebe59d5ca8f2d901816a87681bc540cc223490c0edd393b68113d6
SHA512

eccb280cd34b40f9b73d0027a05827c7a35f59e3fe99a62728a58516cc84e5ac6ec30dd2c1ca028f39e8c6dae615346c0bb6847f6f7fe3cd36fd5fdbd716c0fd
SSDEEP

6144:kOcPZ+zjqCCKsKLjfT123gteD30Llhdwe7W6Evwoe+wiMsvZ0F:k3B8jtrfk3gc/e7W6Evwoe+wiMsviF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
82cbad79dcc761c90cbdee3ea2d53307_JaffaCakes118

Files

82cbad79dcc761c90cbdee3ea2d53307_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\doza\Desktop\Orcus RAT v1.3.1\WindowsApplication1\WindowsApplication1\obj\Debug\WindowsApplication1.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 863KB - Virtual size: 863KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ