266c6dc4a4257e70fcd353b8b791fa1b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

266c6dc4a4257e70fcd353b8b791fa1b_JaffaCakes118
Size

32KB
MD5

266c6dc4a4257e70fcd353b8b791fa1b
SHA1

383efd8cbfe094a84dc644b33da25126191528b2
SHA256

e67fb86f9575fbb98333b46376f7a5c90b71ef6e10f4da04479cf2d022457937
SHA512

a8a2513103cf7809622cee04d601ce39fe39847e23981bf4220afba9760f992481bf63dace7cbcf5b3b2a17ab5a4c60ff5e04270eae984ae88e1641db5f13bd8
SSDEEP

384:xowQC3w/43SYvna9JkVSo41N0yuaJ7S9uYA6Y8gD2jnOC6IIdu1U6ApewPvyMMe:xofSwgS1o41NTuC7S9M6Adh6WewPvp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
266c6dc4a4257e70fcd353b8b791fa1b_JaffaCakes118

Files

266c6dc4a4257e70fcd353b8b791fa1b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5f73fcb443007c1a96d676ec62df1f75

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Program Files\Apache Group\Apache2\htdocs\old\pc\rootkit2\Release\DrvFltIp.pdb

Imports

ntoskrnl.exe

IoReleaseCancelSpinLock
KeRemoveDeviceQueue
IoAcquireCancelSpinLock
IoStartPacket
IoDeleteDevice
KeSetTimer
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
KeServiceDescriptorTable
MmPageEntireDriver
KeInitializeEvent
KeInitializeTimer
KeInitializeDpc
PsSetLoadImageNotifyRoutine
ZwQuerySystemInformation
IoCreateDevice
IoStartNextPacket
ExFreePoolWithTag
ZwClose
ZwWriteFile
ExAllocatePoolWithTag
ZwCreateFile
ExAcquireResourceExclusiveLite
RtlInitUnicodeString
tolower
RtlFreeAnsiString
ZwTerminateProcess
ZwOpenProcess
RtlInitAnsiString
RtlUnicodeStringToAnsiString
ZwSetValueKey
ZwCreateKey
ZwDeleteValueKey
KeRemoveEntryDeviceQueue
KeCancelTimer
MmUnlockPagableImageSection
MmLockPagableDataSection
ExReleaseResourceLite
IofCompleteRequest

hal

KfLowerIrql
ExAcquireFastMutex
ExReleaseFastMutex
HalMakeBeep
KfRaiseIrql

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE