0b1f6f8c0cf91f87974396dc2413c345_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0b1f6f8c0cf91f87974396dc2413c345_JaffaCakes118
Size

134KB
MD5

0b1f6f8c0cf91f87974396dc2413c345
SHA1

414c600f113f1e929acaa277fb205e43df0550fb
SHA256

bcf5373d678ce25a3d7d4e3417a2a1eb49f93593b6a062023ed3062e329442c0
SHA512

1e386dd132007d12592369c1bc92bda03cc9b2ea524508120f054ce729f5946b79f7d94f315f45861bcb3e9ee30a834eb3a2ef808bb3fe5dbd20b61b9058d8ff
SSDEEP

3072:S7b1Q2/Tf4gSdDyCOAtLyu1dETI/EnpRwuNfykENd:Sf22/crmAtGuQbp1ykEN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b1f6f8c0cf91f87974396dc2413c345_JaffaCakes118

Files

0b1f6f8c0cf91f87974396dc2413c345_JaffaCakes118
.dll windows:1 windows x86 arch:x86

5456a6337fa8a857314be43b467d5742

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

strstr
MmMapLockedPagesSpecifyCache
wcsncpy
strncpy
ExAllocatePoolWithTag
KeTickCount
RtlAnsiCharToUnicodeChar
DbgPrint
ObSetHandleAttributes
ObReferenceObjectByHandle
KeQueryTimeIncrement
RtlWalkFrameChain
ZwQuerySystemInformation
KeBugCheckEx
IoCreateDisk
strncmp
IoGetCurrentProcess
FsRtlNotifyCleanup
IoBuildAsynchronousFsdRequest
FsRtlIsNameInExpression
_except_handler3
ExFreePoolWithTag
ExInterlockedPushEntryList
_aullshr
ObfReferenceObject

Sections

.data
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 640B - Virtual size: 635B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 800B - Virtual size: 774B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 192B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE