4720c98d1163aa283172912632580f8d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4720c98d1163aa283172912632580f8d_JaffaCakes118
Size

30KB
MD5

4720c98d1163aa283172912632580f8d
SHA1

0f23718f7643c157f9e16f3d5d450ea553ef1915
SHA256

a910a0f60e75ff856eee88a300a0040a678f72119bf3da13b42f0adb982a44f3
SHA512

6843684ec3c468bc3cc2b5bcb9fb37adeaa3ce25fc1d58e3c4c0cd8e8797f21ac07cd64c569c36c266a11f96602f7d2c41d34ec8080c0e45c0a8dce87d7cce7e
SSDEEP

384:wjftkKY5UNvoxkTsWNVJQENc7TByyBvqGlY/ALsG/mlRBWyLljLkG1IQY9fTjihU:wLtlNQeseu/72rQyL9ZFY9fnihGTIrSJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4720c98d1163aa283172912632580f8d_JaffaCakes118

Files

4720c98d1163aa283172912632580f8d_JaffaCakes118
.sys windows:4 windows x86 arch:x86

caed740047327835987440169debea21

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

PsGetCurrentProcessId

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64B - Virtual size: 35B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 96B - Virtual size: 86B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 64B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ