b099952e4f9b320d0c49ea6ee76b1633_JaffaCakes118 | Triage

Sharing

General

Target

b099952e4f9b320d0c49ea6ee76b1633_JaffaCakes118
Size

18KB
MD5

b099952e4f9b320d0c49ea6ee76b1633
SHA1

bd259134c835531e867ab106a1225586531abd2b
SHA256

a8e39ef6e0eb338db2862fb58dcf363eb0a8ceb75e4ab5bd44018a70c4951936
SHA512

121d0bf1721f8e6672e8aa47c570aa60ce899ccf390827a0191ae5cc9188e0ea928ce665680d4d47a0814daf0d081447ee3340db98178551a3e160b88da50585
SSDEEP

384:sD1+wUJSrcn0gDGhtmY5xP5jy/qLLA+Q9+VS74:L9JSQ2htmMesE+QIVt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b099952e4f9b320d0c49ea6ee76b1633_JaffaCakes118

Files

b099952e4f9b320d0c49ea6ee76b1633_JaffaCakes118
.sys windows:5 windows x86 arch:x86

9f3b0d28086002371ee1981b32bb317b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ObQueryNameString

hal

KfReleaseSpinLock

Sections

.text
Size: 128B - Virtual size: 98B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 32B - Virtual size: 28B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ