2a193edc2379a26b27943ef2e587d05f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2a193edc2379a26b27943ef2e587d05f_JaffaCakes118
Size

119KB
MD5

2a193edc2379a26b27943ef2e587d05f
SHA1

faa21b9b2c73a2dd76aedf1883850f7b11be1ece
SHA256

3ee4b73b76fe265b4a276cf9b54ba17dcf8a8bb5e6611eaf596c0fd7fb6e7325
SHA512

63aecf5e25256ab694fc77ae1ce0847b43d9946379fdd52582543f3d9f5685aff7b789f919d1bd9c8592e911ba9848317824b9a2a89bb3f6e51d1c3b7825693b
SSDEEP

1536:4tDQAqfsed9yUHYkWvt4vq0O5jkpDvxdJbOalO/vWsby+zap+VF6D:4KAqfsed9yU49vGvqbepDvvELvWn+ayK

Score

1^/10

Malware Config

Signatures

Files

2a193edc2379a26b27943ef2e587d05f_JaffaCakes118
.dll windows:5 windows x64 arch:x64

a9f6acf384d67a0486fdf72dcabc7803

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:10:bb:20:84:d7:6c:53:2c:a7:11:e1:0c:3c:f0:6b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

19/03/2014, 00:00

Not After

17/04/2016, 23:59

Subject

CN=Xi'an Xinli Software Technology Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Xi'an Xinli Software Technology Co.\,Ltd.,L=Xi'an,ST=Shaanxi,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ea:1f:cf:54:10:7e:e4:ee:ff:64:af:d8:5d:73:c2:fe:a9:4b:ef:51
Signer

Actual PE Digest

ea:1f:cf:54:10:7e:e4:ee:ff:64:af:d8:5d:73:c2:fe:a9:4b:ef:51

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Work\git\driver\fk_undead\tempobj\rel_x64\fk_drv64\fk_drv.pdb

Imports

ntoskrnl.exe

wcslen
IoDetachDevice
MmIsAddressValid
ObfDereferenceObject
ObReferenceObjectByName
IoDriverObjectType
RtlInitUnicodeString
strstr
RtlCompareMemory
ExAllocatePool
KeSetEvent
KeBugCheckEx
IoFreeIrp
KeClearEvent
KeWaitForSingleObject
IoAllocateIrp
IoGetRelatedDeviceObject
KeInitializeEvent
ZwClose
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
ObReferenceObjectByHandle
IoFileObjectType
DbgPrint
IoCreateFile
IofCallDriver
NtClose
IoReuseIrp
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
RtlAppendUnicodeToString
ZwSetInformationFile
ZwWriteFile
ObfReferenceObject
ZwDeleteFile
wcscat
wcscpy
ZwQueryDirectoryFile
ZwDeleteKey
ZwOpenKey
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
ZwEnumerateKey
ZwQueryKey
ZwSetValueKey
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwQueryValueKey
MmMapLockedPagesSpecifyCache
_strnicmp
MmBuildMdlForNonPagedPool
IoAllocateMdl
_vsnprintf
__C_specific_handler
ExAllocatePoolWithTag
IoBuildDeviceIoControlRequest
IoGetLowerDeviceObject
MmUnlockPages
MmProbeAndLockPages
IoFreeMdl
PsTerminateSystemThread
IoRegisterShutdownNotification
PsGetVersion
MmGetSystemRoutineAddress
rand
srand
PsInitialSystemProcess
IoGetCurrentProcess
PsSetLoadImageNotifyRoutine
PsSetCreateProcessNotifyRoutine
PsRemoveLoadImageNotifyRoutine
IoStartTimer
IoInitializeTimer
CmRegisterCallback
RtlUnicodeStringToAnsiString
RtlUpcaseUnicodeString
RtlCompareUnicodeString
RtlQueryRegistryValues
CmUnRegisterCallback
MmSystemRangeStart
ZwOpenProcess
wcsrchr
ZwQueryInformationProcess
strcmp
RtlImageDirectoryEntryToData
strcpy
RtlFreeUnicodeString
_stricmp
PsGetCurrentProcessId
PsGetProcessImageFileName
KeAreApcsDisabled
ZwFreeVirtualMemory
KeUserModeCallback
ZwAllocateVirtualMemory
PsCreateSystemThread
ZwFlushKey
IoCreateSymbolicLink
IoCreateDevice
IoAttachDeviceToDeviceStack
IoGetDeviceObjectPointer
IofCompleteRequest
RtlTimeToTimeFields
ExSystemTimeToLocalTime
ZwCreateKey
KeSetTimer
KeInitializeDpc
KeInitializeTimer
KeDelayExecutionThread
KeQueryTimeIncrement
ObQueryNameString
strlen
atoi
ExFreePoolWithTag

fltmgr.sys

FltStartFiltering
FltRegisterFilter

Sections

.text
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a9f6acf384d67a0486fdf72dcabc7803

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

13:10:bb:20:84:d7:6c:53:2c:a7:11:e1:0c:3c:f0:6bCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

ea:1f:cf:54:10:7e:e4:ee:ff:64:af:d8:5d:73:c2:fe:a9:4b:ef:51Signer

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

fltmgr.sys

Sections

.text Size: 94KB - Virtual size: 94KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 3KB - Virtual size: 2KB

INIT Size: 3KB - Virtual size: 3KB

.reloc Size: 512B - Virtual size: 60B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

13:10:bb:20:84:d7:6c:53:2c:a7:11:e1:0c:3c:f0:6b
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

ea:1f:cf:54:10:7e:e4:ee:ff:64:af:d8:5d:73:c2:fe:a9:4b:ef:51
Signer

.text
Size: 94KB - Virtual size: 94KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 3KB - Virtual size: 2KB

INIT
Size: 3KB - Virtual size: 3KB

.reloc
Size: 512B - Virtual size: 60B