66ca361bcb5c06cd0d8a4db356b200e6_JaffaCakes118 | Triage

Sharing

General

Target

66ca361bcb5c06cd0d8a4db356b200e6_JaffaCakes118
Size

40KB
MD5

66ca361bcb5c06cd0d8a4db356b200e6
SHA1

94b83bc590cdd9935aa8463acb10a7b3f1c8b378
SHA256

5ba1c7c6beecc6088e5fe16b5f02a9ec95f4c8af90692d9928f928c79b0e2d6c
SHA512

44b1ebfd456d71947230f5a93f237c1af37e5308ada83097128021bcfe16258a09253c172e4185178422fa21cf03c9675cea4578b98b23c3b6dde7ad4b81b331
SSDEEP

768:cwlFnb01s73iDHT76leFRohpj/zTz8zS0Q6eFW1slvwQcJrMvbL+17:cUZw1s74H6C8pHKeFWkWJI+x

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
66ca361bcb5c06cd0d8a4db356b200e6_JaffaCakes118

Files

66ca361bcb5c06cd0d8a4db356b200e6_JaffaCakes118
.sys windows:5 windows x86 arch:x86

efe7240d814b4f461e2923b3b4015cd9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

MmGetSystemRoutineAddress
RtlInitUnicodeString
IoGetCurrentProcess
ExGetPreviousMode
ExAllocatePoolWithTag
IoCreateDevice

Sections

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 256B - Virtual size: 215B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 128B - Virtual size: 30B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ