9099a38d4936d2e3e84035478cfae203_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

9099a38d4936d2e3e84035478cfae203_JaffaCakes118
Size

24KB
MD5

9099a38d4936d2e3e84035478cfae203
SHA1

33a5f49aa176a52eb4af2f60596aac091f347489
SHA256

117949e2cdb0c925d19673b0fcb6e83bbe6daeae7496eddc22f84f8d0499eb6d
SHA512

9d23dfc8bd809d40358116a31235e612e270d5f87ac00fce96c35d217fd3240756837c156866c7bdac125f51a122ef49cad103245800974def26a947bfd1333f
SSDEEP

384:ZKr0HMOI8QdkmAtHoAk6wSnssAobWoD50yW8NGej8gOLMMG:ZICMUDHoAkIWoiT6HIzLHG

Score

1^/10

Malware Config

Signatures

Files

9099a38d4936d2e3e84035478cfae203_JaffaCakes118
.sys windows:6 windows x64 arch:x64

bd10000fe231edf6f75874ff68465ffa

Code Sign

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

85:41:53:f3:56:0b:ca:3b:ce:1e:2b:ed:74:f5:e5:e0
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

18/05/2015, 00:00

Not After

29/12/2015, 23:59

Subject

CN=Jambo Digital ltd,O=Jambo Digital ltd,POSTALCODE=6801294,STREET=2nd Koifman St.,L=Tel-Aviv,ST=Tel-Aviv,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/08/2013, 20:28

Not After

15/08/2023, 20:38

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

05/05/2015, 00:00

Not After

31/12/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

b6:e1:68:02:0c:f5:6f:3e:5c:77:e6:b3:5f:59:76:31:09:35:53:51
Signer

Actual PE Digest

b6:e1:68:02:0c:f5:6f:3e:5c:77:e6:b3:5f:59:76:31:09:35:53:51

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

fltmgr.sys

FltUnregisterFilter
FltRegisterFilter
FltReleaseFileNameInformation
FltParseFileNameInformation
FltStartFiltering
FltGetFileNameInformation

ntoskrnl.exe

ExAllocatePoolWithTag
PsProcessType
ObRegisterCallbacks
IoDeleteSymbolicLink
ExFreePoolWithTag
ObUnRegisterCallbacks
RtlInitUnicodeString
IoDeleteDevice
ObGetFilterVersion
PsSetCreateProcessNotifyRoutineEx
IofCompleteRequest
IoCreateSymbolicLink
PsGetCurrentProcessId
IoCreateDevice
PsGetProcessId
strncmp
KeReleaseSpinLock
ExInterlockedInsertTailList
atol
KeAcquireSpinLockRaiseToDpc
RtlAnsiStringToUnicodeString
ZwQuerySymbolicLinkObject
RtlInitAnsiString
RtlUnicodeStringToAnsiString
ZwOpenSymbolicLinkObject
RtlFreeUnicodeString
ZwClose
RtlFreeAnsiString
toupper
KeBugCheckEx

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 512B - Virtual size: 19B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bd10000fe231edf6f75874ff68465ffa

Code Sign

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

85:41:53:f3:56:0b:ca:3b:ce:1e:2b:ed:74:f5:e5:e0Certificate

Extended Key Usages

Key Usages

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36Certificate

Extended Key Usages

Key Usages

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6Certificate

Extended Key Usages

Key Usages

b6:e1:68:02:0c:f5:6f:3e:5c:77:e6:b3:5f:59:76:31:09:35:53:51Signer

Headers

DLL Characteristics

File Characteristics

Imports

fltmgr.sys

ntoskrnl.exe

Sections

.text Size: 11KB - Virtual size: 10KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 176B

.pdata Size: 512B - Virtual size: 384B

PAGE Size: 512B - Virtual size: 19B

INIT Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 20B

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

85:41:53:f3:56:0b:ca:3b:ce:1e:2b:ed:74:f5:e5:e0
Certificate

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36
Certificate

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

b6:e1:68:02:0c:f5:6f:3e:5c:77:e6:b3:5f:59:76:31:09:35:53:51
Signer

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 176B

.pdata
Size: 512B - Virtual size: 384B

PAGE
Size: 512B - Virtual size: 19B

INIT
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 20B