0d64e6ca52abfcd029e4ba5250a67101_JaffaCakes118 | Triage

Sharing

General

Target

0d64e6ca52abfcd029e4ba5250a67101_JaffaCakes118
Size

31KB
MD5

0d64e6ca52abfcd029e4ba5250a67101
SHA1

32148e1abf146e02d7e3235ce64552750471469e
SHA256

15f894698d01d8defd794f6b4f42357c02f8fd8af13d80a40b47eee45c02bfcb
SHA512

5dbfa6d819810ce85f3d28929b408c3a0f5ed09a1bfc645107fea96b4e819ac94ce775e1cee9414bb7009846ff50467a249497ed5762fb1110feb51d09ba8953
SSDEEP

768:6l020jYss+ZOZfGkjNAA/v17c+QmV818je:62ju+IZfGkegv1o+Ni8a

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d64e6ca52abfcd029e4ba5250a67101_JaffaCakes118

Files

0d64e6ca52abfcd029e4ba5250a67101_JaffaCakes118
.dll windows:5 windows x86 arch:x86

480d8dad9708c2a33a68bd03519ac6c2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

H:\gZfopuT\qjZjbg\xwnwqhlq.pdb

Imports

ntoskrnl.exe

RtlInitializeUnicodePrefix
RtlEqualUnicodeString
RtlInitUnicodeString
RtlPrefixUnicodeString
KeReadStateMutex
RtlCharToInteger
IoWriteErrorLogEntry
RtlEqualString
IoQueueWorkItem
MmBuildMdlForNonPagedPool
RtlUnicodeToOemN
KeInitializeMutex
KdEnableDebugger
RtlUpcaseUnicodeChar
KeLeaveCriticalRegion
RtlCopySid
SeAccessCheck
ZwCreateKey
RtlCompareUnicodeString
strcmp
RtlQueryRegistryValues
RtlInitString
IoGetDeviceInterfaces
RtlInitAnsiString
PsGetCurrentThreadId

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ