227d8367af9aab102c541e73a4b0a9f4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

227d8367af9aab102c541e73a4b0a9f4_JaffaCakes118
Size

134KB
MD5

227d8367af9aab102c541e73a4b0a9f4
SHA1

b53c7e1c6ca204429481ea05b02b81952f1ef955
SHA256

3011e028c53486710907e4aa930c2857f001cf53e4f910723aa1232c7dc90979
SHA512

2d0390e8bc63436c673cb0e44a9999ce99616c248e9c6ec2206731ec6d5ee4a0b4a6549147dde65cd7941a4437c493c3bc3a3f8a501849814a460745f6c7e2d3
SSDEEP

3072:b1RAVKjO28A32zwAppTZ1/MmO6EHRRZaDkXWUtEzW7WEW6WnWE8ivWW:PjO2GtrEHRRZaDPZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
227d8367af9aab102c541e73a4b0a9f4_JaffaCakes118

Files

227d8367af9aab102c541e73a4b0a9f4_JaffaCakes118
.dll windows:1 windows x86 arch:x86

db3beb5131b19e895b978bfbab6af59b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
KeQueryTimeIncrement
_except_handler3
SeReleaseSubjectContext
KeRundownQueue
ExFreePoolWithTag
RtlAnsiCharToUnicodeChar
IoGetCurrentProcess
ZwQuerySystemInformation
RtlInvertRangeList
InterlockedPopEntrySList
wcsncpy
MmMapLockedPagesSpecifyCache
DbgPrint
ObReferenceObjectByHandle
RtlAreBitsClear
strstr
KeBugCheckEx
RtlTimeToSecondsSince1980
KeTickCount
RtlTimeToElapsedTimeFields
strncpy
ObfReferenceObject
strncmp
KeUpdateRunTime

Sections

.data
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 640B - Virtual size: 631B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 800B - Virtual size: 780B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 192B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE