245d4e7b4b02833109844f2ab85bd4f7_JaffaCakes118 | Triage

Sharing

General

Target

245d4e7b4b02833109844f2ab85bd4f7_JaffaCakes118
Size

5KB
MD5

245d4e7b4b02833109844f2ab85bd4f7
SHA1

9106cf72a65244e422b7b4ca9ec3caaf3f429a38
SHA256

91364d23b3a2e022edaa7a2ab5be2cfdaeca33c9c8e5d2ab0311290b6f8fee4c
SHA512

c85b9ae98a4c8d1fdfd0a56c35c77d22f901a2166d6f5aa0e153920b40e3ffa5742ce8eae58045d1cc2a55bfbc991aa191153f3d187ccf210107a21b1c6581d8
SSDEEP

96:RnDi6iiGIaXowjJj8KE7milmQ1k6GsvvV0DB5UVMecByM8sd+mIwA6BH:Rn+a1eSK+VSDcmFyy3kI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
245d4e7b4b02833109844f2ab85bd4f7_JaffaCakes118

Files

245d4e7b4b02833109844f2ab85bd4f7_JaffaCakes118
.dll windows:5 windows x86 arch:x86

e1e1d0a5df64560bc70977dd16416473

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\ADPlus2010\ADPlus5.0\Setup2.0\Setup_Version_3.0\miniDriver\Check\MiniDriver.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString
RtlRandom
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
MmGetSystemRoutineAddress

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 167B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 128B - Virtual size: 50B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 256B - Virtual size: 232B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ