23b1adb06717c5261c593670bd019aef_JaffaCakes118 | Triage

Sharing

General

Target

23b1adb06717c5261c593670bd019aef_JaffaCakes118
Size

132KB
MD5

23b1adb06717c5261c593670bd019aef
SHA1

27ec6894f1093a7bc63211451126650c6b97a5c3
SHA256

020848698b6427795817a38dab1eea5f543525c8b0aa347e7a4be902e97cdc70
SHA512

9dfe7714cb5b81edbb21110af45c2e9cb67ab10c8899c907662ac1c651904ea7aa1b49ce43d43fac5578b26f08d5400ed2d6f420b8b5d2457575bc2abe957374
SSDEEP

3072:ihPjxFeWf2zIs58kO/Wiy8k0EA5lsW7C1rYlDl5ZFzM:ET2sIOeiyOdlsWNhvM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
23b1adb06717c5261c593670bd019aef_JaffaCakes118

Files

23b1adb06717c5261c593670bd019aef_JaffaCakes118
.dll windows:1 windows x86 arch:x86

8a9043c0c80e660f0de8ee7b399f7d3d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

KeBugCheckEx
strstr
strncpy
KeQueryTimeIncrement
KeTickCount
DbgPrint
ZwQuerySystemInformation
wcsncpy
_except_handler3
ObfReferenceObject
RtlAnsiCharToUnicodeChar
ExAllocatePoolWithTag
IoGetCurrentProcess
ExFreePoolWithTag
strncmp
MmMapLockedPagesSpecifyCache
ObReferenceObjectByHandle

Sections

.data
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 160B - Virtual size: 149B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 544B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 192B - Virtual size: 166B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE