guloader | JaffaCakes118_96d690a601fdc6b9384e90cf74d3d72a6210fe34fc9803539fcf3f6a72ff0b6f | Triage

Sharing

General

Target

JaffaCakes118_96d690a601fdc6b9384e90cf74d3d72a6210fe34fc9803539fcf3f6a72ff0b6f
Size

532KB
MD5

cb7fbfd64f9a37ca8853e17edbb0212d
SHA1

e50839748347f5b92e911bb3a408aa400c5a8ea1
SHA256

96d690a601fdc6b9384e90cf74d3d72a6210fe34fc9803539fcf3f6a72ff0b6f
SHA512

b5519229bc67781390826fc6a1930cf5d31bd3d4209f237b945e88b3393e6803d437b79f19fa0a8185809b9d3fd21470646e694b2ec65862dc8a81f50d985686
SSDEEP

3072:WuxVUg3yGDRb8MczuIbvdGVgemxemPG3YqKzjiPOZBhWoOz/tjFIb:JgORDgb79x96YZaPsTOz/G

Score

10^/10

guloader

Malware Config

Signatures

Guloader family
guloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_96d690a601fdc6b9384e90cf74d3d72a6210fe34fc9803539fcf3f6a72ff0b6f

Files

JaffaCakes118_96d690a601fdc6b9384e90cf74d3d72a6210fe34fc9803539fcf3f6a72ff0b6f
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 280KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ