238a6c013ce3c24fc70afb2d93079f6c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

238a6c013ce3c24fc70afb2d93079f6c_JaffaCakes118
Size

6KB
MD5

238a6c013ce3c24fc70afb2d93079f6c
SHA1

f1f442c2a18aa4cd9686579823712e8565a549f5
SHA256

4041ad0db0bef139d3da6a340844e600bb8fe7c953ad1e0b1c1964a4e3c3a813
SHA512

5446d93c30d5ca65f8ed475f32ed5c81482919b2a4f65ba3e54c846df0c44fb1f50dab7a1c6ec5110cf124121287afc6d13cfe704df2a905a014b6b1ac5a770c
SSDEEP

96:i17cpkB7PQgpfkFPIJ31nwYDidyK+SVyOYjWFKFaTnwKeZy2cApxppVSz:iqkBLQri3RviR+SI/6Q+wJZBxH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
238a6c013ce3c24fc70afb2d93079f6c_JaffaCakes118

Files

238a6c013ce3c24fc70afb2d93079f6c_JaffaCakes118
.dll windows:5 windows x86 arch:x86

e610606a11a87777a4b7b6452a47757a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\ADPlus2010\ADPlus5.0\Setup2.0\miniDriver\Check\MiniDriver.pdb

Imports

ntoskrnl.exe

ZwClose
PsCreateSystemThread
RtlDeleteRegistryValue
RtlWriteRegistryValue
RtlCreateRegistryKey
ZwWriteFile
ExFreePoolWithTag
ZwReadFile
ExAllocatePoolWithTag
ZwQueryInformationFile
ZwCreateFile
RtlRandom
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlGetVersion
PsTerminateSystemThread
ZwLoadDriver
RtlAppendUnicodeStringToString
RtlQueryRegistryValues
KeDelayExecutionThread

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 213B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 128B - Virtual size: 50B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 640B - Virtual size: 568B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ