6dc73d7f20b5c082ef8e01e5ddb4be88_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6dc73d7f20b5c082ef8e01e5ddb4be88_JaffaCakes118
Size

54KB
MD5

6dc73d7f20b5c082ef8e01e5ddb4be88
SHA1

1004f205915fca13287cd1ce1a199105e73718bb
SHA256

06dd6b7eb7dd62f8108b8bb170a25ad2f0d3a83e7418b725a0c71acd2297373e
SHA512

ecd936c9347f73eaa334aff7a35b74ef5d7e56e35356dd081af110122f63e7fd8391670b59de454edc6c1e5af458dc295abc1fb43ea3f68bde4b5268efb889bb
SSDEEP

768:2E11Kgf3Cd/vLATdJCySSfIb+D+R3WjTU9pcmFOPxhE0zTdRcNBYrLR7dVqLzDn:b11KgfSFsTcSuI+RmjoImF8T+B6LR7Xk

Score

1^/10

Malware Config

Signatures

Files

6dc73d7f20b5c082ef8e01e5ddb4be88_JaffaCakes118
.sys windows:6 windows x86 arch:x86

b31ed493b230ed03314c939ec342169b

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

53:f0:7c:ba:47:55:8d:64:93:39:d9:f4
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

27/01/2017, 11:00

Not After

31/03/2020, 12:33

Subject

CN=Biz Secure Labs Pvt. Ltd.,O=Biz Secure Labs Pvt. Ltd.,L=Pune,ST=Maharashtra,C=IN,1.2.840.113549.1.9.1=#0c1a737570706f727440696e646961616e746976697275732e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

70:b0:e0:ed:d6:d8:ca:81:46:7d:f4:72:8d:35:6e:1c:50:aa:d6:00
Signer

Actual PE Digest

70:b0:e0:ed:d6:d8:ca:81:46:7d:f4:72:8d:35:6e:1c:50:aa:d6:00

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\projects\projectsj\nfsdk2_latest\driver_tdi\std\objfre_wxp_x86\i386\netfilter2.pdb

Imports

ntoskrnl.exe

IoCreateSymbolicLink
IoCreateDevice
IoDeleteSymbolicLink
IofCompleteRequest
ZwClose
ObfDereferenceObject
ObOpenObjectByPointer
PsLookupProcessByProcessId
MmGetSystemRoutineAddress
RtlInitUnicodeString
IoDetachDevice
IofCallDriver
IoFreeMdl
memcpy
MmBuildMdlForNonPagedPool
IoBuildDeviceIoControlRequest
IoAllocateMdl
PsGetCurrentProcessId
KeWaitForSingleObject
IoDeleteDevice
KeInsertQueueDpc
IoReleaseCancelSpinLock
ObReferenceObjectByHandle
IoFreeIrp
IoAllocateIrp
MmMapLockedPagesSpecifyCache
KeInitializeTimer
KeInitializeDpc
RtlAppendUnicodeToString
IoAttachDeviceToDeviceStack
IoGetDeviceObjectPointer
ObfReferenceObject
KeSetTimer
MmUnmapLockedPages
MmFreePagesFromMdl
MmAllocatePagesForMdl
KeTickCount
KeBugCheckEx
_aullrem
ExFreePoolWithTag
memset
KeInitializeEvent
ExAllocatePoolWithTag
RtlUnwind

hal

KfAcquireSpinLock
KfReleaseSpinLock

tdi.sys

TdiMapUserRequest

Sections

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b31ed493b230ed03314c939ec342169b

Code Sign

04:00:00:00:00:01:25:07:1d:f9:afCertificate

Key Usages

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

61:29:15:27:00:00:00:00:00:2aCertificate

Key Usages

53:f0:7c:ba:47:55:8d:64:93:39:d9:f4Certificate

Extended Key Usages

Key Usages

70:b0:e0:ed:d6:d8:ca:81:46:7d:f4:72:8d:35:6e:1c:50:aa:d6:00Signer

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

tdi.sys

Sections

.text Size: 37KB - Virtual size: 37KB

.rdata Size: 512B - Virtual size: 500B

.data Size: 5KB - Virtual size: 5KB

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 928B

.reloc Size: 2KB - Virtual size: 2KB

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

61:29:15:27:00:00:00:00:00:2a
Certificate

53:f0:7c:ba:47:55:8d:64:93:39:d9:f4
Certificate

70:b0:e0:ed:d6:d8:ca:81:46:7d:f4:72:8d:35:6e:1c:50:aa:d6:00
Signer

.text
Size: 37KB - Virtual size: 37KB

.rdata
Size: 512B - Virtual size: 500B

.data
Size: 5KB - Virtual size: 5KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 928B

.reloc
Size: 2KB - Virtual size: 2KB