2412f9b7ed97ff056abd0552973d7bd4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2412f9b7ed97ff056abd0552973d7bd4_JaffaCakes118
Size

131KB
MD5

2412f9b7ed97ff056abd0552973d7bd4
SHA1

168609776b4655b93135c349137bd873677edc83
SHA256

83e02427cabb5b5d4ff6b5e7519029f5190fef015d761371c6588f4b37400b1a
SHA512

2e98c689793aa12969a819f658f2407e3639551966ab8db4d83a48a29f72bfa2781041df74388c647de84ea5f43114ff0bcae9338b5a4f17b829d27836e89f2f
SSDEEP

1536:2ySdq8sc2pOe+7g81odMHrSD8Z3Xl9oka32EM/fzECBQurch/TV3vSf/vgl6064V:8s3O1cTR32EM/YCBQuri/S4ll6Cag

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2412f9b7ed97ff056abd0552973d7bd4_JaffaCakes118

Files

2412f9b7ed97ff056abd0552973d7bd4_JaffaCakes118
.dll windows:1 windows x86 arch:x86

cd5fac47ec13cfdb5fdff40e3e919782

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

DbgPrint
ZwRestoreKey
KeQueryTimeIncrement
ObReferenceObjectByHandle
_except_handler3
ObLogSecurityDescriptor
ExAllocatePoolWithTag
wcsncpy
FsRtlInitializeOplock
ZwPulseEvent
KeTickCount
strncmp
MmMapLockedPagesSpecifyCache
KeBugCheckEx
ExIsResourceAcquiredExclusiveLite
RtlAddAce
ZwQueryDefaultUILanguage
ZwQuerySystemInformation
ExAllocatePoolWithQuota
strstr
ExFreePoolWithTag
ObfReferenceObject
RtlAnsiCharToUnicodeChar
strncpy
IoGetCurrentProcess

Sections

.data
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 640B - Virtual size: 639B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 800B - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 192B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE