4d33d1d38db68b6436b48b31e535931f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4d33d1d38db68b6436b48b31e535931f_JaffaCakes118
Size

50KB
MD5

4d33d1d38db68b6436b48b31e535931f
SHA1

c049471810f5909d1a7df6354f0f69d7806e547e
SHA256

b4c4a3c54a3cc76f35c46e93bd400249667089234914b49506550072e37bd2a3
SHA512

d484d028b90354996245fcd68698b7844fb99e17e7b85a647558d5eaa044a9728e2c14f1ae11ebb1a8d69a95b832f288bfb55debe2b8f31764ac541c95628821
SSDEEP

768:K5b8/x1Rwhf43YI5lVpZrTAN/0bZfXq5dkR2BCfpKvbGgxi5hPprUg:K5b8/JSf43Y4V728p65dq2cfpseHNU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d33d1d38db68b6436b48b31e535931f_JaffaCakes118

Files

4d33d1d38db68b6436b48b31e535931f_JaffaCakes118
.sys windows:4 windows x86 arch:x86

a6527c3f321b0e49755d02c5ce489fa2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

tcpip.sys

SetIPSecPtr
LookupRoute
IPFreeBuff

hal

HalProcessorIdle
KeRaiseIrql
KfLowerIrql

ntoskrnl.exe

IoPageRead
IoStopTimer
ZwClose

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mad
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dadoc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ