0e4eaff4a610c160e9cfbe4b01463295_JaffaCakes118 | Triage

Sharing

General

Target

0e4eaff4a610c160e9cfbe4b01463295_JaffaCakes118
Size

28KB
MD5

0e4eaff4a610c160e9cfbe4b01463295
SHA1

e2c465dd85af2164780665267b80642bddbfe6d5
SHA256

7f90ff536216b13f0b1edc1fa6a13ae6816ff13c86f88731822dc9cf1e076a8f
SHA512

dbf2aceb7fd8c96674af2b4d71468a01d6d3f3350fcb60241e99b85d1147d74ad7ad704e8836c33c779c19f5ff81b9f95f6123406901d38f4298651325c181ef
SSDEEP

384:/soLQC3w/4SSYNhKIakRSo41N0RFTI5n7Q9nZpoJaiJigIhwPzoqSC0xcwQ:/socSwhSVo41NUFa094J3nIhwroHA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e4eaff4a610c160e9cfbe4b01463295_JaffaCakes118

Files

0e4eaff4a610c160e9cfbe4b01463295_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5f73fcb443007c1a96d676ec62df1f75

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Program Files\Apache Group\Apache2\htdocs\old\pc\rootkit\Release\DrvFltIp.pdb

Imports

ntoskrnl.exe

IoReleaseCancelSpinLock
KeRemoveDeviceQueue
IoAcquireCancelSpinLock
IoStartPacket
IoDeleteDevice
KeSetTimer
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
KeServiceDescriptorTable
MmPageEntireDriver
KeInitializeEvent
KeInitializeTimer
KeInitializeDpc
PsSetLoadImageNotifyRoutine
ZwQuerySystemInformation
IoCreateDevice
IoStartNextPacket
ExFreePoolWithTag
ZwClose
ZwWriteFile
ExAllocatePoolWithTag
ZwCreateFile
ExAcquireResourceExclusiveLite
RtlInitUnicodeString
tolower
RtlFreeAnsiString
ZwTerminateProcess
ZwOpenProcess
RtlInitAnsiString
RtlUnicodeStringToAnsiString
ZwSetValueKey
ZwCreateKey
ZwDeleteValueKey
KeRemoveEntryDeviceQueue
KeCancelTimer
MmUnlockPagableImageSection
MmLockPagableDataSection
ExReleaseResourceLite
IofCompleteRequest

hal

KfLowerIrql
ExAcquireFastMutex
ExReleaseFastMutex
HalMakeBeep
KfRaiseIrql

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE