052d71cd4b7580d20f73afb9e78873ba_JaffaCakes118

General

Target

052d71cd4b7580d20f73afb9e78873ba_JaffaCakes118
Size

183KB
MD5

052d71cd4b7580d20f73afb9e78873ba
SHA1

82afd1eb52ba3d7b67ff8b461e85ff146fd28e0b
SHA256

653a6c720367c1bf4bfdcd9f0f38a46ac8be30807d93feb2fc5a8e091f85243e
SHA512

628278b2b104e6e55824493f50effbe82496117028f25e97a6ebf3d4960992af7643a7afd0d5656bf3a2ccb5bc6040afe01580dd0de658c92b1bbf7d2444e7dd
SSDEEP

3072:9LMPUcZ5apCeJ4//E+7mslheiHsI/U+owztYcegkZq9lz7VOfy+1iVyEdQlK5z:dMPUcgdJ4nE+a6hgiU+dOgaq9lz7VdPT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
052d71cd4b7580d20f73afb9e78873ba_JaffaCakes118

Files

052d71cd4b7580d20f73afb9e78873ba_JaffaCakes118
.dll windows:5 windows x86 arch:x86

3d019df3efa33cb45be53236588e9094

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

S:\mxefdjyfbygl\fJpMqIJkrtClnn\nXswbjHIwmBVp\pfffmyyVPFunx.pdb

Imports

ntoskrnl.exe

IoDeleteSymbolicLink
MmForceSectionClosed
RtlFreeUnicodeString
KeEnterCriticalRegion
KeLeaveCriticalRegion
RtlDeleteElementGenericTable
ZwSetSecurityObject
KdDisableDebugger
IoGetDeviceToVerify
IoCheckEaBufferValidity
CcFastCopyRead
HalExamineMBR
RtlFindClearBitsAndSet
ProbeForRead
IoDeviceObjectType
KeGetCurrentThread
ObInsertObject
IoSetShareAccess
RtlCreateSecurityDescriptor
MmIsThisAnNtAsSystem
RtlFindClearBits
KeInitializeTimer
IoQueueWorkItem
ZwDeleteKey
RtlQueryRegistryValues
IoGetTopLevelIrp
IoInvalidateDeviceRelations
FsRtlCheckLockForReadAccess
ExUnregisterCallback
IoReleaseCancelSpinLock
IoGetBootDiskInformation
KeRestoreFloatingPointState
SeTokenIsRestricted
IoSetTopLevelIrp
ObGetObjectSecurity
PoUnregisterSystemState
IoGetDeviceAttachmentBaseRef
KeQueryInterruptTime
KeTickCount
PsDereferencePrimaryToken
IoGetDiskDeviceObject
MmFreeNonCachedMemory
IoCheckShareAccess
MmFreeMappingAddress
MmHighestUserAddress
IoVerifyVolume
ZwQuerySymbolicLinkObject
RtlAnsiStringToUnicodeString
CcPinMappedData
ExSystemTimeToLocalTime
DbgBreakPointWithStatus
KeReadStateMutex
KeInitializeEvent
ExGetExclusiveWaiterCount

Exports

Exports

?RtlDirectoryExW@@YGPADHPAG<V
?DeleteVersionExW@@YGGD<V
?FindSectionA@@YGFFPA_NGM<V
?ModifyPathExW@@YGKK<V
?SetFilePathW@@YGIPAJJIPAJ<V
?IsNotFileEx@@YGMPAMDF<V

Sections

.text
Size: 45KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3d019df3efa33cb45be53236588e9094

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 45KB - Virtual size: 63KB

.data Size: 4KB - Virtual size: 3KB

.text
Size: 45KB - Virtual size: 63KB

.data
Size: 4KB - Virtual size: 3KB