2f0a8d76eac8f321dd8b9058501e7e32_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2f0a8d76eac8f321dd8b9058501e7e32_JaffaCakes118
Size

132KB
MD5

2f0a8d76eac8f321dd8b9058501e7e32
SHA1

716d0790e862dec9f4b38d37ff61b93b7d22a436
SHA256

0e6ea1659a9b57ac805d741d4d70a1197c067d7a6fa6d6c51452c3cf2a313cf9
SHA512

6cb6b674a2d815ef4ff15e7233aed34f9668537f21c0c5e2b77d78248386bab1a77847a7087050aff137e6459559ca12c028bf028f39296e2df70cb2e03e1f9d
SSDEEP

3072:fVQqq7mwsAw1X2Eb4mpg7EJih0tMYHGzumZeI:fmqq7m1V1GEdpgcih0igUh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f0a8d76eac8f321dd8b9058501e7e32_JaffaCakes118

Files

2f0a8d76eac8f321dd8b9058501e7e32_JaffaCakes118
.dll windows:1 windows x86 arch:x86

7f5acb1a40005e1cf8087ce29eda9078

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

ExFreePoolWithTag
ExAllocatePoolWithTag
wcsncpy
wctomb
_except_handler3
KeTickCount
RtlAnsiCharToUnicodeChar
strncmp
ObfReferenceObject
strncpy
MmMapLockedPagesSpecifyCache
KeQueryTimeIncrement
ExRaiseAccessViolation
DbgPrint
ObReferenceObjectByHandle
IoCreateUnprotectedSymbolicLink
KeBugCheckEx
RtlIpv4StringToAddressExA
IoGetCurrentProcess
RtlEnumerateGenericTableAvl
strstr
RtlOemToUnicodeN
KeBugCheck
CcSetDirtyPageThreshold
ZwQuerySystemInformation

Sections

.data
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 640B - Virtual size: 635B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 800B - Virtual size: 780B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 192B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE