fbf03aaa5d236ad102fd0f68a659ab0e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fbf03aaa5d236ad102fd0f68a659ab0e_JaffaCakes118
Size

29KB
MD5

fbf03aaa5d236ad102fd0f68a659ab0e
SHA1

5afa881ba67635a454983cc760e7d5673978f67c
SHA256

4b21e65c3f66d23cd7bf51e7105951ae58a47cd6e2840b4718c3549d837d1690
SHA512

0674fb1fa1459d5d3b9b3d8e2a896aa35563d1807f8f019ddd11188426fc0630de18025eeda38808644166c989fda2c078e703c9f2a374b20908429a4095f9ae
SSDEEP

768:QtlNsxFacCTgsSjO+oxXmffDUjG3jX4fY6HL:Q1sr5CEZSWffSaYrr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fbf03aaa5d236ad102fd0f68a659ab0e_JaffaCakes118

Files

fbf03aaa5d236ad102fd0f68a659ab0e_JaffaCakes118
.sys windows:4 windows x86 arch:x86

caed740047327835987440169debea21

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

PsGetCurrentProcessId

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64B - Virtual size: 35B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 96B - Virtual size: 86B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 64B - Virtual size: 46B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ