31cde5adc05f4dcb85074d92f4c91d59_JaffaCakes118 | Triage

Sharing

General

Target

31cde5adc05f4dcb85074d92f4c91d59_JaffaCakes118
Size

51KB
MD5

31cde5adc05f4dcb85074d92f4c91d59
SHA1

dcf537e3e1bece0a92cfa193dbf08cab3e49de24
SHA256

31cae56e1c5793058a2acded4157273c0fbb5c2914cdbe1cf9fdd66208da989b
SHA512

d0370fcc28bfd14b64a5ee11f655096a3dc0699882cb8d67f94876e873ab73cdcc43e08eda19c71f32034dcb0e63dd5210d689a134ffde01ea88d54a570367ad
SSDEEP

768:FaX4gNPepNOE0FaZQgoZlJ8O2PRbTqxv1g5/oJ0ZHU5gWj/qNsm0f2DWtiM:iN2HORFaZHEdu5/oJ0m5gK/qyuC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
31cde5adc05f4dcb85074d92f4c91d59_JaffaCakes118

Files

31cde5adc05f4dcb85074d92f4c91d59_JaffaCakes118
.sys windows:4 windows x86 arch:x86

e13503e6bbaa15825e6e5d6009c25030

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

tdi.sys

TdiRegisterNetAddress
TdiRegisterProvider
TdiInitialize

hal

HalProcessorIdle
KeRaiseIrql
KfLowerIrql

ntoskrnl.exe

IoPageRead
isdigit
ZwClose

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tre
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xadoc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ