c8bf852848f034ff5e80bcf8e85e814c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c8bf852848f034ff5e80bcf8e85e814c_JaffaCakes118
Size

261KB
MD5

c8bf852848f034ff5e80bcf8e85e814c
SHA1

7bfa12958eb2e8de0fc015a60201a5a8a06f9841
SHA256

bbbbef279ea73c2d4a9e19c8f293b2e5b559145243504b8bc5db78fe4f3bd02b
SHA512

bbfa8fc26e89e8d1cb89e4d36a2be43d131bb79cf612ef906660c2ae785dfc0cb20303f25eb00bd8c502f25b4379b28bebc047ef254a7453dcacc62afcad8fc4
SSDEEP

6144:UcMxb41zDJiLOyXU78eh4stgPAowIQQLYSl:UcMxs18L/ctECQESl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c8bf852848f034ff5e80bcf8e85e814c_JaffaCakes118

Files

c8bf852848f034ff5e80bcf8e85e814c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\projects\pc connectivity solution\pccs 3.10\source files\platform\media servers\nclirsrv\mediahandler\win32\release\NclIrSrv.pdb

Sections

.text
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gda
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE