41a7a98dc38747530acfd910aaad34d2_JaffaCakes118 | Triage

Sharing

General

Target

41a7a98dc38747530acfd910aaad34d2_JaffaCakes118
Size

1.8MB
MD5

41a7a98dc38747530acfd910aaad34d2
SHA1

91c3d4d33b984535547b192d4c2228fa27179049
SHA256

cc7d0c9bd688601cffbbc41003a16ae4776e578c36e9c158b25d996259397e44
SHA512

0d4d5c4748c1a2ddc705401ee2e6bf9a1634765d3de4a4ea7d546a9e31cde6202100cc07e3c46f0007ff10c7b2bdea6db2fd384be70fdf35966692db32c0acc9
SSDEEP

49152:EaBLzGzEk/n1oOvDdftBpKiOwaCJd7Fe3:tlzGzEktoOvJftBkdTCH7Fe3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41a7a98dc38747530acfd910aaad34d2_JaffaCakes118

Files

41a7a98dc38747530acfd910aaad34d2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\monkey\RomePC.Nightly.SKU.SecuRomClient\TnT\Code\TnT\Tools\Updater\BFHeroesUpdater\Updater\Release\BFUpdater.pdb

Sections

.text
Size: 432KB - Virtual size: 431KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vsp
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE