61cb9aa4f65adda45375ddcd3045bc69_JaffaCakes118 | Triage

Sharing

General

Target

61cb9aa4f65adda45375ddcd3045bc69_JaffaCakes118
Size

44KB
MD5

61cb9aa4f65adda45375ddcd3045bc69
SHA1

7a9d545dbd61a350da53f491963d250e6eb23505
SHA256

e2d0fc5b9aebf7349639ad12c879a22b738ee82f8e233b89bddaff2c7dc4c309
SHA512

103bb75448085499599d1c584ad05e512e2336ea50791b930253ad4868514baf0c533f8d058399cb080fcce85a6990413697402af7a6137b98bcb01fdb360d84
SSDEEP

768:0pAmNG2kGikQaEaLwZF5MPtjRgK2n/HHxW4c1kgrYwCvgOTn/6/n:f0G21iP6MF5udz2/HHklJmnin

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
61cb9aa4f65adda45375ddcd3045bc69_JaffaCakes118

Files

61cb9aa4f65adda45375ddcd3045bc69_JaffaCakes118
.sys windows:6 windows x86 arch:x86

8936ed0bd55aa2b6b0940dde71825080

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoAttachDevice
PsGetCurrentProcessId
MmIsAddressValid
ExAllocatePoolWithTag
KeTickCount
ExFreePoolWithTag

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 137B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 384B - Virtual size: 282B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 384B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ