01ddfc30ebd1282bd3b92c5841ea0385_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

01ddfc30ebd1282bd3b92c5841ea0385_JaffaCakes118
Size

5KB
MD5

01ddfc30ebd1282bd3b92c5841ea0385
SHA1

6ada2dd804a9fba69be634ae3c9feb240fc4d72f
SHA256

17c02d7b3e11cf3d7356135fc173ba8f24980df3e9c4496fb7fff5c0ff83cd71
SHA512

fa15d1c23decd52e16a1674e35d549ee6434d34eefc302119d1f35907b5fa797f9b78d7fb28f4fc3158d25837979f0382be96fdd74d5afc8bdc2dc5f81a6cd3e
SSDEEP

96:ZkPU0UoQoR3/IJ+6qt6MW5N9QtUPlQxa11Gi:ZkPU0UoQoRvIs6C6rQttx0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01ddfc30ebd1282bd3b92c5841ea0385_JaffaCakes118

Files

01ddfc30ebd1282bd3b92c5841ea0385_JaffaCakes118
.exe windows:5 windows x86 arch:x86

3325a1a4fcabd2c615283d9ae29fc5b0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlFreeAnsiString
RtlCompareMemory
RtlUpperString
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
PsGetCurrentProcessId
ZwQueryDirectoryFile
ZwDeviceIoControlFile
IoDeleteDevice
IoDeleteSymbolicLink
wcscat
RtlFreeUnicodeString
wcscpy
RtlAnsiStringToUnicodeString
IofCompleteRequest
KeServiceDescriptorTable
IoCreateSymbolicLink
IoCreateDevice

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 640B - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 640B - Virtual size: 526B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 128B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 256B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ