27667a381bac0d42020fa41531b8e905_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

27667a381bac0d42020fa41531b8e905_JaffaCakes118
Size

331KB
MD5

27667a381bac0d42020fa41531b8e905
SHA1

79075b1c1706d1a660674908bb69d7356179644f
SHA256

9680e9edcc8f692d6c1ea1d8a247e3db560f7172caec3d855cb541c981c55d84
SHA512

4673f89b91c9dcff2238acc8f6680abe79768572c3ec22e03ec2d02a8a69dc3bc1d7905a29749c6d891ac46af34275287d120321fa6886f7568ee1fa6ce97f14
SSDEEP

6144:fYcvKhJn0bit87Cqi/zznv4sGA8sxWae6u2Bya/rtU61I+AK3uK6HxjnLJtQodWR:fUJ0bitBqWLus4ae6lyap1I+Ayu7Hxja

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27667a381bac0d42020fa41531b8e905_JaffaCakes118

Files

27667a381bac0d42020fa41531b8e905_JaffaCakes118
.dll windows:5 windows x86 arch:x86

533a934e8fc1ef6118683ae3491dd71a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Z:\vuYs\kbfc\gsyuJl.pdb

Imports

ntoskrnl.exe

IoMakeAssociatedIrp
IoFreeMdl
KeRemoveEntryDeviceQueue
ObGetObjectSecurity
RtlInitString
KeInitializeSpinLock
KdDisableDebugger
RtlInitUnicodeString
CcRemapBcb
KeCancelTimer
KeQueryInterruptTime
RtlEqualString
IoAllocateController
RtlWriteRegistryValue
KeInitializeTimerEx
strncpy
RtlEqualUnicodeString
ExSetResourceOwnerPointer
RtlCompareString
RtlUnicodeToOemN
RtlValidSid
KeInitializeApc
IoCreateSymbolicLink
ExAllocatePoolWithTag
RtlIntegerToUnicodeString

Sections

.text
Size: 25KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 724B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ