purecrypter | JaffaCakes118_721ca39067f2164cba68b1817bdc90228b7fa217e5014647b82f44043c211937

General

Target

JaffaCakes118_721ca39067f2164cba68b1817bdc90228b7fa217e5014647b82f44043c211937
Size

5KB
MD5

0d4b63664e58c185f8a9a817ddad39b7
SHA1

b556e88e7b85553f7f48396d7d2b6ec507ef4112
SHA256

721ca39067f2164cba68b1817bdc90228b7fa217e5014647b82f44043c211937
SHA512

b98368f5c4a1ee327c4ee3b4bea3e9a9434de579fb6f8d1caadead38222585729311c0863c5e2da70f430792e89fb1847321aacbe968fa250e4584052c23566e
SSDEEP

96:R8tHK46OktfWUcaqx/L10BLFAL3Iu0+4s5/TcZuapgc6uRhQIevzm0bjyXvFb/:+19gpcaQzGD45Goc6uRvwdyfx

Score

10^/10

purecrypter

Family

purecrypter

C2

https://iriseagle.com/img/loader/uploads/Cakaenu.bmp

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/8dbe87dfd43e58019a522dfc28c6cdcdbdeb646bef58ce4e725e3b726e06c607

JaffaCakes118_721ca39067f2164cba68b1817bdc90228b7fa217e5014647b82f44043c211937
.zip

Password: infected
8dbe87dfd43e58019a522dfc28c6cdcdbdeb646bef58ce4e725e3b726e06c607
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ