2dfe75eca24aae5af55858d53087f7d5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2dfe75eca24aae5af55858d53087f7d5_JaffaCakes118
Size

72KB
MD5

2dfe75eca24aae5af55858d53087f7d5
SHA1

3e5059a08639eec55fd562c2937be4e7dd41125c
SHA256

5eccbbc6707008a4996af3a2f5be760018877b707b27909715211a98d32b5089
SHA512

e0527e3bade42b74e0fb1fc64ba7c255f46b4f706eb425b48e8154df05ba8fb9b383548cc381b1561256342e105b54a801611f168261927e9f105c2c166b3492
SSDEEP

1536:4M1JkcS+0/ogfxAGN3sXOC80WtoA9nmis4+7UmlPFgIfLFeUj:4MJHaxAWc/woAAif+7VPFHeUj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2dfe75eca24aae5af55858d53087f7d5_JaffaCakes118

Files

2dfe75eca24aae5af55858d53087f7d5_JaffaCakes118
.dll windows:4 windows x86 arch:x86

51b1ee20612d765d2b53a2039f614be4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

KeQueryPriorityThread
RtlLookupElementGenericTable
RtlRealSuccessor
RtlSetAllBits
RtlDeleteOwnersRanges
KeFlushEntireTb

hal

KfRaiseIrql
HalDisableSystemInterrupt
HalProcessorIdle
HalSetDisplayParameters
WRITE_PORT_BUFFER_UCHAR
IoMapTransfer
KeAcquireQueuedSpinLockRaiseToSynch
HalTranslateBusAddress
HalEnableSystemInterrupt
HalRequestSoftwareInterrupt
HalMakeBeep
KeGetCurrentIrql

Sections

.data
Size: - Virtual size: 88KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 575B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ