72a2602351274d142a51f32d96121528_JaffaCakes118 | Triage

Sharing

General

Target

72a2602351274d142a51f32d96121528_JaffaCakes118
Size

60KB
MD5

72a2602351274d142a51f32d96121528
SHA1

541ef235998f0de3f25771cacdfb86d04c332299
SHA256

a16a6fc3800d544bfb7755f408eb42b91a2927f67dbd01c43a6272b34f7e5d51
SHA512

b19d228d44de95715403ab1c432f7e4d99ee1e8c67e14c4060fcefe0c89e0bd30828cad024b4da03f0914e98da417b6af6d6b1627dbae738f96377db3927aa77
SSDEEP

1536:cVBkBDQ/IIzzdrq+wnGn8fRY9M2qdd9VwQo2ZD:8kBDQAazJq+IGn8fRFBZRB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
72a2602351274d142a51f32d96121528_JaffaCakes118

Files

72a2602351274d142a51f32d96121528_JaffaCakes118
.sys windows:5 windows x86 arch:x86

e18f76114fd186f08a1bfb5457ffba78

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
ObfDereferenceObject

Sections

.text
Size: 512B - Virtual size: 417B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 128B - Virtual size: 114B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ