02a7308f491724061aa7f9a27bf46b84_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

02a7308f491724061aa7f9a27bf46b84_JaffaCakes118
Size

66KB
MD5

02a7308f491724061aa7f9a27bf46b84
SHA1

1c714054caeea42d39d3987407d2a97e8ad009b7
SHA256

59036b81bac5054efd54a0cf3a30cb161d6740cdbb7e8ba9d9b833bf93a6d48f
SHA512

3a7b130ebc98c9c00223548b8d899444fd480db91c4393a82a31e98b42e053a25949662de504e68e4d4726b6e167b1789a9a4702012dbbc15c7aabc3595f4c8a
SSDEEP

1536:QenS3SvkXH+DfAJnlaqG4+LZ/HwubVCJoCCJUj/:FhvKH8If/+hH9VUoCCJUj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
02a7308f491724061aa7f9a27bf46b84_JaffaCakes118

Files

02a7308f491724061aa7f9a27bf46b84_JaffaCakes118
.dll windows:5 windows x86 arch:x86

3856e5305768ca79725552f5be198036

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

R:\hxdginletczd\gaavyqbynzvi\rtzjonvhcQMA\sYccFHeGfXe\HfOtmFyCRgt.pdb

Imports

ntoskrnl.exe

RtlCopyUnicodeString
RtlSetBits
RtlEqualUnicodeString
KeRevertToUserAffinityThread
FsRtlSplitLargeMcb
RtlFreeOemString
ExUuidCreate
KeSetTimer
RtlInsertUnicodePrefix
IoCreateSymbolicLink
IoGetAttachedDeviceReference
RtlFindClearBitsAndSet
IoAllocateAdapterChannel
IoReleaseRemoveLockEx
IoWritePartitionTableEx
FsRtlCheckLockForReadAccess
PsGetCurrentProcessId
RtlxOemStringToUnicodeSize
MmProbeAndLockProcessPages
ZwCreateDirectoryObject
PoRegisterSystemState
ObOpenObjectByPointer
MmIsVerifierEnabled
FsRtlFastCheckLockForRead
ExFreePoolWithTag
CcFastCopyRead
ExReleaseFastMutexUnsafe
CcInitializeCacheMap
CcMdlReadComplete
SeQueryAuthenticationIdToken
MmMapUserAddressesToPage
IoConnectInterrupt
RtlGUIDFromString
SeSetSecurityDescriptorInfo
ObfDereferenceObject
RtlGetNextRange
MmIsDriverVerifying
ZwDeleteKey
CcFastMdlReadWait
KeInsertByKeyDeviceQueue
ExGetSharedWaiterCount
RtlRemoveUnicodePrefix
ZwQueryObject
IoCheckEaBufferValidity
SeCaptureSubjectContext
KeRemoveQueueDpc
KeInsertQueueDpc
IoAcquireVpbSpinLock
ExRaiseAccessViolation
KeRestoreFloatingPointState
KeClearEvent
ExAllocatePoolWithTag
ZwCreateKey
RtlUnicodeToMultiByteN
SeTokenIsAdmin
RtlMapGenericMask
IoStopTimer
IoFreeErrorLogEntry
MmBuildMdlForNonPagedPool
ZwQuerySymbolicLinkObject
PsGetProcessId
ZwOpenProcess
PsCreateSystemThread
IoVolumeDeviceToDosName
PsChargeProcessPoolQuota
KeSetPriorityThread
RtlLengthSid
IoCancelIrp
IoCreateDisk
ExQueueWorkItem
DbgPrompt
IoEnumerateDeviceObjectList
KeSetSystemAffinityThread
IoReadPartitionTable
RtlInitAnsiString
RtlOemToUnicodeN
RtlCopyString
CcDeferWrite
IoIsSystemThread
RtlAnsiCharToUnicodeChar
ExDeleteNPagedLookasideList
MmForceSectionClosed
ZwReadFile
IoWMIWriteEvent
ObGetObjectSecurity
RtlUpcaseUnicodeToOemN
KeInitializeDeviceQueue
IoCreateNotificationEvent
ObReleaseObjectSecurity
KdDisableDebugger
KeInitializeDpc
IoAcquireCancelSpinLock
KeInitializeApc
ZwQueryValueKey
ExReleaseResourceLite
ZwQueryVolumeInformationFile
IoDeleteSymbolicLink
RtlClearBits
MmAllocateContiguousMemory
RtlGenerate8dot3Name
MmUnlockPages
RtlCreateRegistryKey
ExVerifySuite
IoSetStartIoAttributes
RtlDelete
RtlTimeToSecondsSince1980
KeSetTargetProcessorDpc
ExUnregisterCallback
MmSetAddressRangeModified
IoCheckShareAccess
RtlInitializeBitMap
IoGetRequestorProcess
ExIsProcessorFeaturePresent
MmFreeMappingAddress
IoReuseIrp
CcPreparePinWrite
PsRevertToSelf
RtlEqualString
ZwQueryInformationFile
IoSetDeviceInterfaceState
FsRtlIsNameInExpression
MmPageEntireDriver
MmQuerySystemSize
RtlFindUnicodePrefix
RtlNumberOfClearBits
SeAccessCheck
IoSetPartitionInformation
CcMdlWriteComplete
RtlInitUnicodeString
ExReinitializeResourceLite
MmSizeOfMdl
CcPurgeCacheSection
IoSetHardErrorOrVerifyDevice
ObReferenceObjectByPointer
RtlAddAccessAllowedAce
IoInvalidateDeviceState
MmUnlockPagableImageSection
KeBugCheck
PsTerminateSystemThread
IoGetBootDiskInformation
IoRaiseHardError
ExDeletePagedLookasideList
IoAllocateController
RtlFindSetBits
CcIsThereDirtyData
IoGetDeviceObjectPointer
ExRaiseStatus
RtlEqualSid
KeEnterCriticalRegion
PsImpersonateClient
IoDeviceObjectType
PsLookupThreadByThreadId
KePulseEvent
RtlLengthRequiredSid
KeReadStateSemaphore
IoGetTopLevelIrp
KeInitializeQueue
ZwOpenKey
IoGetDeviceToVerify
SeAssignSecurity
IoCsqRemoveIrp
IoVerifyPartitionTable
KeDetachProcess
KeDeregisterBugCheckCallback
KeRemoveByKeyDeviceQueue
RtlCopyLuid
MmUnsecureVirtualMemory
IoStartTimer
ExAcquireFastMutexUnsafe
KeResetEvent
SeReleaseSubjectContext
RtlDeleteElementGenericTable
KeRundownQueue
RtlGetVersion
SeFreePrivileges
KeBugCheckEx
ZwOpenSection
KeSynchronizeExecution
IoRequestDeviceEject
IoFreeWorkItem
SePrivilegeCheck
IoWriteErrorLogEntry
ZwCreateSection
RtlFreeUnicodeString
KeSetTimerEx
IoQueryDeviceDescription
IoCreateStreamFileObjectLite
PsSetLoadImageNotifyRoutine
IoReportResourceForDetection
KeWaitForSingleObject
PoSetPowerState
WmiQueryTraceInformation
IoGetDriverObjectExtension
PsGetProcessExitTime
DbgBreakPoint
KefAcquireSpinLockAtDpcLevel
RtlCopySid
RtlFindLongestRunClear
CcMapData
RtlSetDaclSecurityDescriptor
RtlInitializeSid
MmMapIoSpace
KeInitializeSpinLock
ExFreePool
IoAllocateErrorLogEntry
PsGetCurrentThread
RtlDowncaseUnicodeString
ExSystemTimeToLocalTime
CcFlushCache
KeUnstackDetachProcess
IoSetThreadHardErrorMode
IoGetDeviceAttachmentBaseRef
RtlCreateSecurityDescriptor
RtlOemStringToUnicodeString
IoThreadToProcess
RtlFindNextForwardRunClear
ExAllocatePoolWithQuotaTag
RtlSubAuthoritySid
FsRtlIsTotalDeviceFailure
KeInitializeSemaphore
KeInitializeTimerEx
ZwFsControlFile
MmAllocatePagesForMdl
IoGetDeviceInterfaces
ZwFreeVirtualMemory
MmGetPhysicalAddress
MmAddVerifierThunks
RtlHashUnicodeString
VerSetConditionMask
CcSetBcbOwnerPointer
RtlAppendUnicodeToString
RtlUpperString
ZwSetSecurityObject
KeSetKernelStackSwapEnable
ZwSetVolumeInformationFile
MmUnmapLockedPages
RtlTimeToTimeFields
KeInsertHeadQueue
RtlCompareString
ObfReferenceObject
KdEnableDebugger
KeReleaseMutex
KeQueryActiveProcessors
ZwQueryKey
ExLocalTimeToSystemTime
RtlCompareMemory
RtlClearAllBits
IoRegisterFileSystem
KeSetBasePriorityThread
RtlFindClearRuns
RtlAreBitsClear
MmMapLockedPagesSpecifyCache
CcUnpinData
RtlSplay
KeRemoveEntryDeviceQueue
IoCreateDevice
RtlAppendStringToString
IoGetDmaAdapter
IoGetCurrentProcess
ZwPowerInformation

Exports

Exports

?CallDataNew@@YGMF~U
?CallProjectNew@@YGMMKPAK~U
?KillFolderPathExA@@YGPA_NPAFFK~U
?RemoveProjectOld@@YGPAHPAE~U
?IncrementVersion@@YGIPAIPAG~U
?CallPathA@@YGFE~U
?RtlSizeOriginal@@YGPAXPAGPAKFPAI~U
?IsValidSectionExW@@YGHPAMK~U
?ValidateListItem@@YGHPAH~U
?IncrementEventEx@@YGEJEPAI~U
?SendPathEx@@YGEPAMPAE~U
?CancelMemoryOriginal@@YGXIPAHPAH~U
?LoadProfileNew@@YGPAXPAHIM~U
?FindData@@YGHPAM_NPAI~U
?ArgumentNew@@YGPAIJDPA_NG~U
?EnumFunctionOld@@YGXJ~U
?KillTimeExW@@YGMPAE~U
?DeleteDeviceExA@@YGKPAIGND~U
?IsConfigNew@@YGJEG~U
?IsDirectoryExW@@YGIPAMD~U
?IsValidTaskEx@@YGIPAGGPAI~U
?CloseModuleW@@YGEPAHE~U
?AppNameA@@YGPAJPANPAJ~U
?CrtModuleW@@YGEIJ~U
?FindDialogExW@@YGPAIE~U
?ProjectEx@@YGXJ~U
?IsNotArgumentNew@@YGXE~U
?IsValidProcessW@@YGFG~U
?ValidateMessageA@@YGPAX_NGG~U
?CrtListExA@@YGPAFPAF~U
?AddHeaderExA@@YGPAXI~U
?ModifyPathA@@YGMPAI~U
?EnumCommandLineExA@@YGGE~U
?InvalidateSizeEx@@YGPAMDJF~U
?DecrementProfileOriginal@@YGPAIJG~U
?LoadDialog@@YGPAGJ~U

Sections

.text
Size: 29KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.i_data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.e_data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hostc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hosta
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.hostb
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hostd
Size: 1024B - Virtual size: 709B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3856e5305768ca79725552f5be198036

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 29KB - Virtual size: 41KB

.i_data Size: 1KB - Virtual size: 1KB

.e_data Size: 1KB - Virtual size: 1KB

.hostc Size: 512B - Virtual size: 28B

.hosta Size: 512B - Virtual size: 44B

.hostb Size: 512B - Virtual size: 44B

.hostd Size: 1024B - Virtual size: 709B

.data Size: 18KB - Virtual size: 18KB

.rsrc Size: 512B - Virtual size: 16B

.reloc Size: 1024B - Virtual size: 696B

.text
Size: 29KB - Virtual size: 41KB

.i_data
Size: 1KB - Virtual size: 1KB

.e_data
Size: 1KB - Virtual size: 1KB

.hostc
Size: 512B - Virtual size: 28B

.hosta
Size: 512B - Virtual size: 44B

.hostb
Size: 512B - Virtual size: 44B

.hostd
Size: 1024B - Virtual size: 709B

.data
Size: 18KB - Virtual size: 18KB

.rsrc
Size: 512B - Virtual size: 16B

.reloc
Size: 1024B - Virtual size: 696B