84dedb4d83fb5b121eaf60c4822895f5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

84dedb4d83fb5b121eaf60c4822895f5_JaffaCakes118
Size

1.5MB
MD5

84dedb4d83fb5b121eaf60c4822895f5
SHA1

0ea436d0adb50418531c592ab670e438c1760921
SHA256

6a1c0e6ad12aacb774b47d256761314b6635a597799921e04f86527868dee4e8
SHA512

cbe475c5315e479593e8aefa9340d5f97a2e0f7a1301e24a62e65c367c3365331ea0b333423f268cd1af796811ef6f345b52252ae0c047ec4c48b5f8cc469b66
SSDEEP

12288:Yyxcm9Zs3JcJHinwRZ0i5Yd97YTro11V3OT62ZjOV:SmTWdh1V3/2ZjOV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
84dedb4d83fb5b121eaf60c4822895f5_JaffaCakes118

Files

84dedb4d83fb5b121eaf60c4822895f5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\NPS_VSS_ROOT\NPS\bin\release\program files\NPSBinaryUpgrade.pdb

Sections

.text
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.heb
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE