911b9698861e6bda0070f0f4f93c290d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
911b9698861e6bda0070f0f4f93c290d_JaffaCakes118
Size 47KB
Sample240603-ka38gaac76
SHA256 123090abffb445a80e1bc1505079b51aa808b14c9b0570f09608af0c368bf885
MD5 911b9698861e6bda0070f0f4f93c290d
SHA1 8026e340cac7f44410da101866ce8f05efb301de
SHA512 9b99e556a1f3baac8ff42b4dd557f6d99838a144a07cd682990ce2a6181edf7e7890cead2ff529023206669240aa47b7284709d65cfd1eb688494eb0f207e679
SSDEEP 768:lE7G2EjsnyXeOUEGG0LA8tWFZuL470h6aqxcCT2kvsVRwlZD3pUA:GFID6EGnLA8AFJTNEVmDH
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

911b9698861e6bda0070f0f4f93c290d_JaffaCakes118

.sys 47KB

911b9698861e6bda0070f0f4f93c290d_JaffaCakes118

IMPHASH d924cf3cd6cb16a79106a721adc63bad
SHA256 123090abffb445a80e1bc1505079b51aa808b14c9b0570f09608af0c368bf885
MD5 911b9698861e6bda0070f0f4f93c290d
SHA1 8026e340cac7f44410da101866ce8f05efb301de
SHA512 9b99e556a1f3baac8ff42b4dd557f6d99838a144a07cd682990ce2a6181edf7e7890cead2ff529023206669240aa47b7284709d65cfd1eb688494eb0f207e679
SSDEEP 768:lE7G2EjsnyXeOUEGG0LA8tWFZuL470h6aqxcCT2kvsVRwlZD3pUA:GFID6EGnLA8AFJTNEVmDH
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

f5:6e:97:3b:8b:21:95:e8:04:3d:4c:af:96:ba:ee:d6:2d:7d:22:87

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=WunderWeb,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=WunderWeb,L=San Diego,ST=California,C=US

Chains

Jun 23, 2015

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=WunderWeb,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=WunderWeb,L=San Diego,ST=California,C=US

Serial Number

76:6c:8e:d1:33:45:66:ab:29:51:38:a9:9f:e0:38:d9

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 13, 2013 - Aug 13, 2015

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

49252

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntoskrnl.exe

KeBugCheckEx ZwOpenKey ZwClose RtlInitUnicodeString ExUuidCreate IoAllocateMdl IoReleaseCancelSpinLock IoCreateDevice MmFreePagesFromMdl PsGetCurrentProcessId IoCreateSymbolicLink IofCompleteRequest KeInsertQueueDpc MmMapLockedPagesSpecifyCache IoFreeMdl MmBuildMdlForNonPagedPool MmAllocatePagesForMdl KeInitializeDpc RtlAppendUnicodeToString IoDeleteDevice KeRemoveQueueDpc IoDeleteSymbolicLink MmUnmapLockedPages KeAcquireSpinLockRaiseToDpc ExDeleteNPagedLookasideList ExQueryDepthSList ExpInterlockedPopEntrySList KeReleaseSpinLock ExpInterlockedPushEntrySList ExInitializeNPagedLookasideList ExFreePoolWithTag ExAllocatePoolWithTag __C_specific_handler

fwpkclnt.sys

FwpsFlowAssociateContext0 FwpsCalloutUnregisterByKey0 FwpmSubLayerAdd0 FwpsQueryPacketInjectionState0 FwpmSubLayerEnum0 FwpmTransactionCommit0 FwpmSubLayerCreateEnumHandle0 FwpmSubLayerDestroyEnumHandle0 FwpmProviderContextDeleteByKey0 FwpmCalloutAdd0 FwpsAllocateCloneNetBufferList0 FwpmProviderAdd0 FwpmTransactionAbort0 FwpmEngineOpen0 FwpsAcquireClassifyHandle0 FwpmFilterAdd0 FwpsPendClassify0 FwpsCalloutRegister1 FwpmTransactionBegin0 FwpmEngineClose0 FwpmFreeMemory0 FwpsAcquireWritableLayerDataPointer0 FwpmBfeStateGet0 FwpmBfeStateSubscribeChanges0 FwpmBfeStateUnsubscribeChanges0 FwpsDiscardClonedStreamData0 FwpsReleaseClassifyHandle0 FwpsStreamInjectAsync0 FwpsCompleteClassify0 FwpsCloneStreamData0 FwpsFlowRemoveContext0 FwpsFreeCloneNetBufferList0 FwpsApplyModifiedLayerData0 FwpsInjectTransportSendAsync0 FwpsCopyStreamDataToBuffer0 FwpsInjectTransportReceiveAsync0 FwpsInjectionHandleCreate0 FwpsAllocateNetBufferAndNetBufferList0 FwpsConstructIpHeaderForTransportPacket0 FwpsInjectionHandleDestroy0 FwpsFreeNetBufferList0

ndis.sys

NdisAllocateGenericObject NdisGetDataBuffer NdisWaitEvent NdisAllocateNetBufferListPool NdisInitializeEvent NdisRetreatNetBufferDataStart NdisFreeGenericObject NdisAdvanceNetBufferDataStart NdisFreeNetBufferListPool

Name

.text

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

984B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

808B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

911b9698861e6bda0070f0f4f93c290d_JaffaCakes118

PE Signature issue

ntoskrnl.exe

fwpkclnt.sys

ndis.sys

generic