30c99b71056f070641c1b1c351a74f88_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

30c99b71056f070641c1b1c351a74f88_JaffaCakes118
Size

134KB
MD5

30c99b71056f070641c1b1c351a74f88
SHA1

eaeb80c4768a49109a553dc63d83d89f8210ec61
SHA256

0042db1b43e3e4e4f2180b20922cc288893e9431f8b45004bc151dd01a93231a
SHA512

79b319043db0a1ffe32363195181cba96171be341f7480b714e865f4e8b29ea42123a7016751a5b9ff316aeb3e412d60b176dc8616d6507ca9594bbe984f38b6
SSDEEP

3072:JFqlVSjEzNJ/CYjd2xkgp0ttS56Ov+nCTPk3hSpYWgdVSq/:J0SjgJ/wxR0tYWCGbrN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
30c99b71056f070641c1b1c351a74f88_JaffaCakes118

Files

30c99b71056f070641c1b1c351a74f88_JaffaCakes118
.dll windows:1 windows x86 arch:x86

2f72ccd6bfff9d30918ea4469bc7582a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

KeBugCheckEx
ObfReferenceObject
ExAllocatePoolWithTag
SePrivilegeObjectAuditAlarm
strstr
strncmp
DbgPrint
wcsncpy
strncpy
CcMdlWriteAbort
RtlAnsiCharToUnicodeChar
ObReferenceObjectByHandle
MmMapLockedPagesSpecifyCache
ZwQuerySystemInformation
IoDisconnectInterrupt
_except_handler3
ExFreePoolWithTag
KeTickCount
IoGetCurrentProcess
ZwSetInformationProcess
IoCheckEaBufferValidity
PoCallDriver
InbvInstallDisplayStringFilter
RtlPinAtomInAtomTable
KeQueryTimeIncrement

Sections

.data
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 640B - Virtual size: 638B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 800B - Virtual size: 790B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 192B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE