04411d87df77da5f312c603007f7da72_JaffaCakes118 | Triage

Sharing

General

Target

04411d87df77da5f312c603007f7da72_JaffaCakes118
Size

80KB
MD5

04411d87df77da5f312c603007f7da72
SHA1

2ef2e22e9fe5b7e1563f3295b920981e6a4c08eb
SHA256

09c8bc9c9ba871eddec54b9485bd2990d6b8ee791eab60bcd6fd28a6fc088fab
SHA512

e78be7171a2a74d417ad145e59ab0bd52209b8a4f8f0b02fdb5f08411f9aa4645a3501bf6310ea21b95495575c8a68164408fb8aaf2177b7fe5be6473b67fe07
SSDEEP

1536:MVByaUzVykvdCKLlWxXn1Bryf+TYOtLEX+qQIHna4/vtdXLe9WXapeVV7:fldfgnXG2UOtqL13nKUye/7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04411d87df77da5f312c603007f7da72_JaffaCakes118

Files

04411d87df77da5f312c603007f7da72_JaffaCakes118
.sys windows:4 windows x86 arch:x86

caed740047327835987440169debea21

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

PsGetCurrentProcessId

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 96B - Virtual size: 86B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ