bb43bcef2aa9b30633151818a6332f05_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bb43bcef2aa9b30633151818a6332f05_JaffaCakes118
Size

55KB
MD5

bb43bcef2aa9b30633151818a6332f05
SHA1

db70797a0bcb276f579f1b2f24bcf80d21689efb
SHA256

2c4e5baf295d5e1c8e0061819335b7c1a57607a15925c06cf61873df06a3dc76
SHA512

7d95d3b8ac0773bd837b2f24cf269a2fed8343f74ee205413fa1e48ccd52fd3493a5d701c9e530a27aaf91f97ed55120ad59f8dab206f4351d694394365ce287
SSDEEP

768:EC+7Q9muy39O9y8VUfEDOTSyK/c+4ZAsnkaNLqLbcWlLh5MwcPQJ7Adt3kCk3BOd:EC+8MD39CyogKsjLzWwQCvI3B1U/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bb43bcef2aa9b30633151818a6332f05_JaffaCakes118

Files

bb43bcef2aa9b30633151818a6332f05_JaffaCakes118
.sys windows:4 windows x86 arch:x86

ced2203b2940cdbac4fbc41ab77a70a7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

hal

KfLowerIrql
KfRaiseIrql
KfReleaseSpinLock

ntoskrnl.exe

strstr
ZwCreateFile
strcpy

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.unc
Size: 29KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ