8f7cbd3b6294a51d05d845817a537c12_JaffaCakes118 | Triage

Sharing

General

Target

8f7cbd3b6294a51d05d845817a537c12_JaffaCakes118
Size

2.2MB
MD5

8f7cbd3b6294a51d05d845817a537c12
SHA1

f8111013086ed399ca719f7ae1971b647791832e
SHA256

a38318931bf23ba293888c2685d85b3cb376d86ca16d3348f7f5ed57165ac1a8
SHA512

9759316db3b0b76e4ea97a40633f83800bed52433f803b195bae27282a98b877b94dae9fb832da87ab279876bcbe60a5dd23d97aefece3d9f7cd00fd39f31898
SSDEEP

49152:dcAVHF/hLAkvUG0M7tRUlCnlSNPMzEvmhzQ9QJmqpcg5INw/8hPBTLF39:dNhLAybDRXY0zQS7crNdhPL3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8f7cbd3b6294a51d05d845817a537c12_JaffaCakes118

Files

8f7cbd3b6294a51d05d845817a537c12_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Administrator\Downloads\Nitro-Ransomware-master\NitroRansomware\obj\Release\NitroRansomware.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ