njrat | 8d804fd1e20e9776ca65abd0a940d2a0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8d804fd1e20e9776ca65abd0a940d2a0_JaffaCakes118
Size

262KB
MD5

8d804fd1e20e9776ca65abd0a940d2a0
SHA1

11d4c3e4ed84188d97dffa128e84f800231b336f
SHA256

f061d3948aece0c1572e9a2cb35a8b747d60e738fe2c739ee599a1b4cbc7234c
SHA512

c5237d030edf1f0b573ff5d09beedb3c763d16491df49ac78d6bb399a303d03ac3f5b4738b9bb5ab72bafaae629fbc0ec3bfcb11fd36be0a01dd93202d8cfcc2
SSDEEP

1536:zdoTsBr4WLgG6xUVhAAp5uReTcLFW9EJLdyRWuJU:zddBr4KgG6xmp5uPwEJLI0p

Score

10^/10

njrat

Malware Config

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8d804fd1e20e9776ca65abd0a940d2a0_JaffaCakes118

Files

8d804fd1e20e9776ca65abd0a940d2a0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Documents and Settings\1134\My Documents\Visual Studio 2008\Projects\72389 binder stub\72389 binder stub\obj\Debug\72389 binder stub.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ