2629aaae55833d0645c4478dddb55168_JaffaCakes118 | Triage

Sharing

General

Target

2629aaae55833d0645c4478dddb55168_JaffaCakes118
Size

66KB
MD5

2629aaae55833d0645c4478dddb55168
SHA1

f3e1c9d7e3d3a8448ade21757177bb13c93eb6b6
SHA256

43688c6da0928750b76704aa30e5b0282f3e7b0ad3f1dc311d278e2297e40337
SHA512

45ed7053ebc75f8ab3cfb7dd21ef2085e8d2c371aa9824e3bec9f3772914ef60844c286556fbb9623af88a45ef5a25e2ab197420a9e4b79aeabb3801042d4e9c
SSDEEP

1536:CCdV9lbtEjWFe/mbPPZytER9Sdx30I9Mm9/kpao/EWbLo:FL0IpPZ7R9A3fMakpao/BH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2629aaae55833d0645c4478dddb55168_JaffaCakes118

Files

2629aaae55833d0645c4478dddb55168_JaffaCakes118
.dll windows:4 windows x86 arch:x86

1724926f250d74e57ae202d8155c470b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

hal

KeQueryPerformanceCounter

ntoskrnl.exe

KeTickCount
PsGetCurrentThreadId
KeInitializeTimer
KeInitializeMutex
KeInitializeEvent
IoGetCurrentProcess
KeGetCurrentThread
PsGetVersion
MmQuerySystemSize
KeQueryActiveProcessors
memcpy
memset
PsGetCurrentProcessId
KeInitializeSpinLock

Sections

.text
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384B - Virtual size: 340B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128B - Virtual size: 14B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 512B - Virtual size: 450B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 896B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ