75ecd2ce3bce5a8209b4a22a24fd57b0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

75ecd2ce3bce5a8209b4a22a24fd57b0_JaffaCakes118
Size

19KB
MD5

75ecd2ce3bce5a8209b4a22a24fd57b0
SHA1

3438f323c3cc0ad9feace26e6f7ba92e53875ec8
SHA256

6d2fd7ebddd913e3a73e570297bc323bbf1139f20d398609213b8f13e9c78421
SHA512

2e9477b16a2096d815c24b8f138d4d089f75dd38752fa94ff19694062f96b3329cdc6baafa3ff522a047d6ade6209a90450198f6de1127f631ad563da90758b3
SSDEEP

384:GvAskmqBtZE5AzY52RXCxXBhgFDGZSZEe:oqRPq2RyWDGle

Score

1^/10

Malware Config

Signatures

Files

75ecd2ce3bce5a8209b4a22a24fd57b0_JaffaCakes118
.sys windows:5 windows x86 arch:x86

ba8f823187f6cda43c84cf444912a486

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

27/04/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49
Certificate

Issuer

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/05/2019, 00:00

Not After

30/05/2020, 10:48

Subject

CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:0c:ee:6b:db:9b:e8:e0:53:f7:e9:71:6e:94:4b:0c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2020, 00:00

Not After

21/09/2020, 12:00

Subject

CN=暴风集团股份有限公司,O=暴风集团股份有限公司,ST=北京市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

98:fc:9a:a4:cc:bb:b0:e5:b6:2b:5d:95:29:e5:d1:cb:d1:fd:d7:33
Signer

Actual PE Digest

98:fc:9a:a4:cc:bb:b0:e5:b6:2b:5d:95:29:e5:d1:cb:d1:fd:d7:33

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\BFWORKSPACE\workspace\暴风主干官网\trunk2\App\Player\BFDrv\BFDrv\Release\BFDrv.pdb

Imports

ntoskrnl.exe

wcsrchr
_wcsicmp
RtlInitUnicodeString
RtlEqualUnicodeString
ExAllocatePool
wcsstr
RtlFreeUnicodeString
ZwSetValueKey
IofCompleteRequest
RtlCopyUnicodeString
ZwOpenKey
ZwQueryKey
ZwEnumerateKey
RtlAppendUnicodeStringToString
RtlQueryRegistryValues
ExFreePoolWithTag
ZwClose
KeGetCurrentThread
ExGetPreviousMode
ProbeForRead
ZwOpenFile
ZwQueryInformationFile
ZwReadFile
strstr
ZwCreateKey
ZwQueryValueKey
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
KeServiceDescriptorTable
ZwQuerySystemInformation
RtlInitAnsiString
RtlAnsiStringToUnicodeString
ZwSetInformationFile
PsGetVersion
MmGetSystemRoutineAddress
ObReferenceObjectByHandle
ObQueryNameString
ObfDereferenceObject
memset
_except_handler3

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 532B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ba8f823187f6cda43c84cf444912a486

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4bCertificate

Key Usages

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19Certificate

Extended Key Usages

Key Usages

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0e:0c:ee:6b:db:9b:e8:e0:53:f7:e9:71:6e:94:4b:0cCertificate

Extended Key Usages

Key Usages

98:fc:9a:a4:cc:bb:b0:e5:b6:2b:5d:95:29:e5:d1:cb:d1:fd:d7:33Signer

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 5KB - Virtual size: 4KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 48B

PAGE Size: 512B - Virtual size: 156B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 532B

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19
Certificate

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0e:0c:ee:6b:db:9b:e8:e0:53:f7:e9:71:6e:94:4b:0c
Certificate

98:fc:9a:a4:cc:bb:b0:e5:b6:2b:5d:95:29:e5:d1:cb:d1:fd:d7:33
Signer

.text
Size: 5KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 48B

PAGE
Size: 512B - Virtual size: 156B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 532B