2a53bc180b9a9b2d17a727a12a4125fe_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2a53bc180b9a9b2d17a727a12a4125fe_JaffaCakes118
Size

106KB
MD5

2a53bc180b9a9b2d17a727a12a4125fe
SHA1

b5cb2e31b732a7691bd461d94624d58783529129
SHA256

dca1f3ec754e0fd87ad42ad879b064ae853d138d1f09adb117655eb40c8a0c1c
SHA512

85b329eaa17e7f7a397cfeab83de123ff0ac447b436baffc73c345342d2fe67f110995f1833ef5fafb33b88c05c6bfc297ab6e52c51749beed33d6e3089b8053
SSDEEP

1536:44H2ekAANY2pP1wFY6letkmVaMzoXLkomKuwqjEwy:/YS2RUY6l/MkLajEN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2a53bc180b9a9b2d17a727a12a4125fe_JaffaCakes118

Files

2a53bc180b9a9b2d17a727a12a4125fe_JaffaCakes118
.dll windows:5 windows x86 arch:x86

929fe348282c68fe1427e42d6142e032

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

R:\pekmPnee\cajzaXn\oRatqgPWRtikd\zxeuasd\qOXxbOeqxWNzb.pdb

Imports

ntoskrnl.exe

RtlFindLastBackwardRunClear
IoAllocateController
ObOpenObjectByPointer
ZwQueryKey
RtlSetBits
ZwDeleteKey
IoReportDetectedDevice
RtlGUIDFromString
RtlFindMostSignificantBit
IoGetDriverObjectExtension
SeTokenIsRestricted
IoGetAttachedDevice
RtlFindUnicodePrefix
RtlSecondsSince1970ToTime
ZwOpenSection
IoReleaseRemoveLockEx
PsIsThreadTerminating
ZwOpenSymbolicLinkObject
ObfReferenceObject
KeSetImportanceDpc
ZwQueryVolumeInformationFile
KeInitializeDpc
ZwDeleteValueKey
ZwEnumerateKey
KeInitializeDeviceQueue
PsGetVersion
RtlIsNameLegalDOS8Dot3
IoDeviceObjectType
CcFastMdlReadWait
IoAcquireCancelSpinLock
KeSetTimer
MmMapIoSpace
IoReadDiskSignature
KeInitializeQueue
KeDelayExecutionThread
ZwCreateSection
CcMdlRead
KeSaveFloatingPointState
KeBugCheckEx
CcCopyRead
ExSetTimerResolution
MmUnlockPagableImageSection
MmAdvanceMdl
CcUnpinData
IoInvalidateDeviceRelations
CcFastCopyWrite
ZwSetValueKey
RtlFindLongestRunClear
RtlFindNextForwardRunClear
RtlCopyString
ExCreateCallback
RtlOemStringToUnicodeString
IoQueryFileInformation
RtlDeleteElementGenericTable
IoAcquireRemoveLockEx
KeQueryTimeIncrement
MmAllocateContiguousMemory
SeDeassignSecurity
IoCreateStreamFileObjectLite
PsChargeProcessPoolQuota
MmGetPhysicalAddress
IoCreateFile
RtlFindLeastSignificantBit
RtlGetCallersAddress
ZwQueryObject
PsGetProcessExitTime
ExRaiseStatus
MmUnmapReservedMapping
MmBuildMdlForNonPagedPool
MmIsVerifierEnabled
RtlUnicodeStringToAnsiString
ZwLoadDriver
KeInitializeSpinLock
KeSynchronizeExecution
KeRemoveQueueDpc
CcGetFileObjectFromBcb
RtlOemToUnicodeN
RtlEqualUnicodeString
RtlxAnsiStringToUnicodeSize
ObGetObjectSecurity
ZwWriteFile
CcUnpinRepinnedBcb
MmFreePagesFromMdl
RtlInsertUnicodePrefix
KeCancelTimer
RtlEqualSid
MmSetAddressRangeModified
RtlCharToInteger
FsRtlCheckLockForWriteAccess
RtlFindClearBits
RtlCompareMemory
KeRundownQueue
IoUpdateShareAccess
IoDeleteSymbolicLink
IoWriteErrorLogEntry
IoGetBootDiskInformation
MmUnlockPages
ZwNotifyChangeKey
ExDeleteResourceLite
PoCallDriver
ExGetExclusiveWaiterCount
RtlAnsiCharToUnicodeChar
FsRtlAllocateFileLock
DbgBreakPoint
IoAllocateWorkItem
MmPageEntireDriver
RtlUpcaseUnicodeToOemN
IoIsWdmVersionAvailable
CcFlushCache
IoReuseIrp
ExAcquireFastMutexUnsafe
IoSetDeviceToVerify
KeDeregisterBugCheckCallback
RtlDelete
RtlInitAnsiString
CcPinRead
ExGetSharedWaiterCount
ZwQueryValueKey
ExFreePool
IoReadPartitionTableEx
IoCheckEaBufferValidity
MmFreeMappingAddress
FsRtlIsDbcsInExpression
KeRemoveDeviceQueue
RtlCopySid
RtlxOemStringToUnicodeSize
IoWMIWriteEvent
KdEnableDebugger
MmResetDriverPaging
RtlDeleteNoSplay
MmGetSystemRoutineAddress
KeRevertToUserAffinityThread
CcIsThereDirtyData
PsGetCurrentProcessId
ExNotifyCallback
IoStartPacket
ExSystemTimeToLocalTime
MmSizeOfMdl
FsRtlFastUnlockSingle
VerSetConditionMask
CcSetDirtyPinnedData
RtlCopyUnicodeString
KeSetTimerEx
ExRaiseAccessViolation
RtlEqualString
ExInitializeResourceLite
IoRemoveShareAccess
PoStartNextPowerIrp
RtlVolumeDeviceToDosName
MmQuerySystemSize
RtlGenerate8dot3Name
RtlSubAuthoritySid
MmProbeAndLockProcessPages
ZwFlushKey
IoDeleteController
KeGetCurrentThread
PoUnregisterSystemState
KePulseEvent
RtlUnicodeStringToOemString
ExFreePoolWithTag
IofCallDriver
RtlCreateAcl
ZwClose
IoAcquireVpbSpinLock
DbgPrompt
MmFlushImageSection
IoAllocateMdl
SeFreePrivileges
ZwAllocateVirtualMemory
IoSetShareAccess
KeInitializeEvent
IoConnectInterrupt
KeSetTargetProcessorDpc
ExAllocatePoolWithQuotaTag
IoSetStartIoAttributes
KeInitializeMutex
ObInsertObject
CcRemapBcb
SeLockSubjectContext
PsGetCurrentThread
RtlAreBitsSet
IoStopTimer
RtlTimeToTimeFields
ZwOpenProcess
MmUnmapIoSpace
IoCreateDisk
RtlInitString
RtlSetDaclSecurityDescriptor
IoFreeIrp
RtlxUnicodeStringToAnsiSize
KeReleaseSemaphore
KeRestoreFloatingPointState
IoVerifyPartitionTable
CcZeroData
KeInsertByKeyDeviceQueue
RtlExtendedIntegerMultiply
RtlRandom
RtlTimeToSecondsSince1970
KeSetSystemAffinityThread
IoReadPartitionTable
KeRemoveQueue
PsRevertToSelf
ProbeForRead
IoStartTimer
RtlPrefixUnicodeString
ObReferenceObjectByHandle
ExAllocatePoolWithTag
ExReleaseResourceLite
KeRegisterBugCheckCallback
SeFilterToken
IoGetDmaAdapter
CcCanIWrite
IoCancelIrp
IoInitializeIrp
IoQueryDeviceDescription
CcMdlWriteComplete
SeAppendPrivileges
IoGetDeviceInterfaces
KeReadStateTimer
FsRtlIsNameInExpression
IoBuildPartialMdl
IoDeleteDevice
IoReleaseVpbSpinLock
MmAllocatePagesForMdl
IoGetTopLevelIrp
MmAllocateMappingAddress
SeCaptureSubjectContext
ExIsProcessorFeaturePresent
IoOpenDeviceRegistryKey
KeLeaveCriticalRegion
IoFreeController
ExVerifySuite
RtlFreeUnicodeString
IoGetDeviceObjectPointer
SeOpenObjectAuditAlarm
MmFreeNonCachedMemory
KeInsertQueue
MmUnmapLockedPages
RtlCheckRegistryKey
RtlEnumerateGenericTable
SeDeleteObjectAuditAlarm
RtlInt64ToUnicodeString
IoCsqRemoveIrp
FsRtlFastCheckLockForRead
KeReadStateSemaphore
IoRegisterFileSystem
KeInitializeSemaphore
SeReleaseSubjectContext
IoCheckShareAccess
ExSetResourceOwnerPointer
ZwOpenFile
ExLocalTimeToSystemTime
RtlTimeFieldsToTime

Exports

Exports

?IsNotMessageOriginal@@YGPAI_N&U
?IsNotDateTimeEx@@YGPAXPAMPAFDI&U
?GlobalSystemA@@YGXJGDK&U
?CancelFunctionExW@@YGJIJ&U
?InstallDateTimeA@@YGGJGIN&U
?ProcessA@@YGFPAH_N&U
?IsFilePathW@@YGXNPAEI&U
?CloseTaskNew@@YGIDM&U
?InvalidateFullNameNew@@YGFPANF&U
?FindRectExA@@YGPA_NEPAG&U
?SetProjectOld@@YGPA_NH&U
?ModifySemaphore@@YGXGKGF&U
?CancelKeyNameExW@@YGDDK&U
?CloseArgumentExW@@YGPAIDH&U
?CancelProfileEx@@YGGMN&U
?HideMemoryExW@@YGXDFF&U
?RemoveConfigEx@@YGIPAFIPA_NF&U
?InvalidatePathA@@YGXEPAIPAIH&U
?IsNotMediaTypeOld@@YG_NIH&U
?InsertTimerW@@YGJKPAJ&U
?FormatDialogA@@YGMPAKI_NPAF&U
?KillDateTimeEx@@YGPAHPAGJPAMPAF&U
?CopyValueExA@@YGGDPAMPAM&U
?GenerateDataExA@@YGPA_NI&U
?VersionA@@YGKPADPAGG&U
?ValidateDialogExA@@YGPAFN_ND&U
?InstallSizeExW@@YGEF&U
?PutDirectoryEx@@YGJI&U
?GetDirectoryW@@YG_NPAIGPAH&U
?LoadValue@@YGKKPAH&U
?AddSystemA@@YGPAIPAF&U
?PutSizeNew@@YGXPAHNEH&U

Sections

.text
Size: 28KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.i_data
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.e_data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hostc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hosta
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.hostb
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hostd
Size: 512B - Virtual size: 266B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 652B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

929fe348282c68fe1427e42d6142e032

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 54KB

.i_data Size: 1024B - Virtual size: 1016B

.e_data Size: 1KB - Virtual size: 1KB

.hostc Size: 512B - Virtual size: 28B

.hosta Size: 512B - Virtual size: 44B

.hostb Size: 512B - Virtual size: 44B

.hostd Size: 512B - Virtual size: 266B

.data Size: 37KB - Virtual size: 36KB

.rsrc Size: 9KB - Virtual size: 8KB

.reloc Size: 1024B - Virtual size: 652B

.text
Size: 28KB - Virtual size: 54KB

.i_data
Size: 1024B - Virtual size: 1016B

.e_data
Size: 1KB - Virtual size: 1KB

.hostc
Size: 512B - Virtual size: 28B

.hosta
Size: 512B - Virtual size: 44B

.hostb
Size: 512B - Virtual size: 44B

.hostd
Size: 512B - Virtual size: 266B

.data
Size: 37KB - Virtual size: 36KB

.rsrc
Size: 9KB - Virtual size: 8KB

.reloc
Size: 1024B - Virtual size: 652B