d4150bbcb5e08ac584c03319f75b1298_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d4150bbcb5e08ac584c03319f75b1298_JaffaCakes118
Size

50KB
MD5

d4150bbcb5e08ac584c03319f75b1298
SHA1

12fd96863505b5b4ac0a31e9811fe0afcddf4a5d
SHA256

f47a80e7e7533a2e1ae46cfc40c234980a5ad88ea28edc49eb456c88846c84ff
SHA512

832916390afa56e64b3dcbf504180ef0b97ba0dcb1bfbef4135f0e2ad7f80a52bfee5dab351b72cf4ad3d5d0a85dc6cb797d506c9bef59c0a2558f26d7709602
SSDEEP

1536:R5p8/JSf43Y4Y7PTsm7BC1otUs4ZkLHg:RrsSaY4SPp7B6gUsRHg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d4150bbcb5e08ac584c03319f75b1298_JaffaCakes118

Files

d4150bbcb5e08ac584c03319f75b1298_JaffaCakes118
.sys windows:4 windows x86 arch:x86

a6527c3f321b0e49755d02c5ce489fa2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

tcpip.sys

SetIPSecPtr
LookupRoute
IPFreeBuff

hal

HalProcessorIdle
KeRaiseIrql
KfLowerIrql

ntoskrnl.exe

IoPageRead
IoStopTimer
ZwClose

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mad
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dadoc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ