1919c15a52ab845c00b92f7603a63003_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1919c15a52ab845c00b92f7603a63003_JaffaCakes118
Size

34KB
MD5

1919c15a52ab845c00b92f7603a63003
SHA1

685731da14be94f24a8b843240db32f84ed9628c
SHA256

368a24790c7437eda6c9c042969ac93c7c2e173bfc197a5a0e1efa3a73d8ec88
SHA512

4f2544f5a729ad5edfd6d1d3f069183e73f815459fced7d1f38b71e55a89d799e6208f8fd35067b22eec2302d7e8105ce4f8d44e19936387cba2fdd1d9c46b57
SSDEEP

768:wfqkWFWsfUTWIOl5ehWORAQOC68mEbee2w5sdZnDg:EqkWFXoZOlAzbOlbw5cZD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1919c15a52ab845c00b92f7603a63003_JaffaCakes118

Files

1919c15a52ab845c00b92f7603a63003_JaffaCakes118
.dll windows:4 windows x86 arch:x86

2ea0677b19d8af7b5913998347e66057

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

ZwDeleteFile
ZwOpenFile
MmGetSystemRoutineAddress

hal

HalDisplayString
KeRaiseIrql

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ