2d226895bf5a16212966fab83bf37f99_JaffaCakes118 | Triage

Sharing

General

Target

2d226895bf5a16212966fab83bf37f99_JaffaCakes118
Size

134KB
MD5

2d226895bf5a16212966fab83bf37f99
SHA1

d606fc10cc2d9371c2d4a7d2884951f3a7385428
SHA256

c6b1ce35b55a2b65da0f56f4ae3899ff5654e84efc093c9958b04fe1e06e4baa
SHA512

0fb05573dddc043ef7226148643896e2586efdd4ef7caddb7d497106e26f1289c8def99251e38ee21015410fc38c45f8076ba8beeb74c3762f81850f7aa6e7a4
SSDEEP

3072:QRARXCGjqgROQ0KHedxaS/5d7VU40ruRjrlhLkvN/2ir2w:QRARXqFIHedxaQ5d7L4uR3YvN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2d226895bf5a16212966fab83bf37f99_JaffaCakes118

Files

2d226895bf5a16212966fab83bf37f99_JaffaCakes118
.dll windows:1 windows x86 arch:x86

4f1c47de62fc0e7a1ef477b715f39f6a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

IoPageRead
MmMapLockedPagesSpecifyCache
ExFreePoolWithTag
RtlWriteRegistryValue
ZwQuerySystemInformation
DbgPrint
PsEstablishWin32Callouts
KeTickCount
RtlAnsiCharToUnicodeChar
IoGetCurrentProcess
ObfReferenceObject
PsGetThreadProcessId
RtlUnicodeStringToCountedOemString
KeBugCheckEx
IoCreateFileSpecifyDeviceObjectHint
FsRtlInitializeFileLock
strstr
_except_handler3
wcsncpy
ExAllocatePoolWithTag
ObReferenceObjectByHandle
strncmp
strncpy
KeQueryTimeIncrement
RtlTimeToElapsedTimeFields

Sections

.data
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 640B - Virtual size: 636B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 832B - Virtual size: 814B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 192B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE