3af7c22a54a3ad3af46e8fb8d80cf5df_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

3af7c22a54a3ad3af46e8fb8d80cf5df_JaffaCakes118
Size

56KB
MD5

3af7c22a54a3ad3af46e8fb8d80cf5df
SHA1

d2482f0abf6cd25cdf55ffe1e0000865366c03a2
SHA256

872c5e2754e2c8215d014808b8fb657850920acde7cdd3184a449c60aa55f051
SHA512

dda78e820badfe44f66527684c8dfd6849a34316a5b84e300530c3109cb2ab71bed63c295ca3228d617418bf84a171d3ac5ad6330aabdb0df0798a2a8e2224e3
SSDEEP

1536:/X5XcJziYn3t75tMIShZIfm1IRcWG6NC2JcQ:t4Z3t7sHQmSG6NC2Jf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3af7c22a54a3ad3af46e8fb8d80cf5df_JaffaCakes118

Files

3af7c22a54a3ad3af46e8fb8d80cf5df_JaffaCakes118
.dll windows:5 windows x86 arch:x86

c437f430728abac96081eee0aef44518

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

P:\adjxlQkuojxciX\pHCcVqiGNydfZ\LxuVvaBcosqgt\redmjwTIuf.pdb

Imports

ntoskrnl.exe

RtlExtendedIntegerMultiply
CcPurgeCacheSection
ExRaiseDatatypeMisalignment
IoIsOperationSynchronous
KeSetSystemAffinityThread
IoGetRelatedDeviceObject
RtlCreateSecurityDescriptor
SeUnlockSubjectContext
IoVolumeDeviceToDosName
CcSetDirtyPinnedData
RtlFindLastBackwardRunClear
CcFastMdlReadWait
RtlAreBitsClear
SePrivilegeCheck
RtlSetDaclSecurityDescriptor
SeAccessCheck
IoCreateStreamFileObject
IoAcquireCancelSpinLock
PoCallDriver
KeReleaseSemaphore
RtlCheckRegistryKey
DbgBreakPointWithStatus
KeQueryTimeIncrement
ExVerifySuite
SeQueryAuthenticationIdToken
IoInitializeRemoveLockEx
IoStopTimer
ZwQueryVolumeInformationFile
IoStartNextPacket
FsRtlSplitLargeMcb
RtlFindUnicodePrefix
CcSetBcbOwnerPointer
IoReleaseRemoveLockAndWaitEx
IoAcquireRemoveLockEx
ZwAllocateVirtualMemory
ExDeleteNPagedLookasideList
CcFastCopyWrite
KeQueryActiveProcessors
KeInitializeDpc
KeWaitForSingleObject
IoReleaseVpbSpinLock
IoGetRequestorProcessId
ZwSetVolumeInformationFile
RtlHashUnicodeString
PoSetSystemState
RtlInitializeSid
ExLocalTimeToSystemTime
RtlNtStatusToDosError
CcZeroData
IoReleaseCancelSpinLock
RtlTimeToSecondsSince1980
KeReadStateSemaphore
MmCanFileBeTruncated
IoSetSystemPartition
KeEnterCriticalRegion
IoSetShareAccess
PsGetCurrentThreadId
IoCreateStreamFileObjectLite
ZwCreateFile
IoIsWdmVersionAvailable
RtlFindLongestRunClear
RtlGUIDFromString
ObInsertObject
IoGetStackLimits
RtlCopyUnicodeString
IoReadPartitionTable
RtlUpcaseUnicodeString
IoDeviceObjectType
RtlUnicodeStringToInteger
KeRemoveQueueDpc
ExDeletePagedLookasideList
PsLookupProcessByProcessId
KeRemoveDeviceQueue
RtlTimeToSecondsSince1970
ObReferenceObjectByPointer
ExAllocatePool
RtlInitAnsiString
IoInvalidateDeviceRelations
IoReportResourceForDetection
IoWMIRegistrationControl
IoQueueWorkItem
PsSetLoadImageNotifyRoutine
KeSetTargetProcessorDpc
IoSetDeviceToVerify
RtlCopyString
ExAcquireResourceSharedLite
RtlVolumeDeviceToDosName
ZwCreateDirectoryObject
FsRtlFastUnlockSingle
SeOpenObjectAuditAlarm
FsRtlIsHpfsDbcsLegal
DbgPrompt
RtlOemStringToUnicodeString
RtlCreateUnicodeString
IoGetLowerDeviceObject
CcCanIWrite
IoAcquireVpbSpinLock
MmIsVerifierEnabled
ZwOpenKey
IoCreateDisk
FsRtlNotifyInitializeSync
ExSystemTimeToLocalTime
MmFreeMappingAddress
KeResetEvent
IoQueryDeviceDescription
RtlEqualSid
CcRepinBcb
SeAppendPrivileges
ExRaiseAccessViolation
PsDereferencePrimaryToken
IoReadPartitionTableEx
CcCopyRead
IoOpenDeviceRegistryKey
KeClearEvent
KeStackAttachProcess
ZwMapViewOfSection
MmBuildMdlForNonPagedPool
IoStartTimer
RtlFindClearBitsAndSet
IoCheckQuotaBufferValidity
RtlValidSid
RtlAnsiCharToUnicodeChar
IoUnregisterFileSystem
RtlAddAccessAllowedAceEx
IoRequestDeviceEject
RtlEqualUnicodeString
ZwUnloadDriver
MmAllocateContiguousMemory
KeSaveFloatingPointState
IoMakeAssociatedIrp
KeReadStateEvent
RtlValidSecurityDescriptor
IoGetTopLevelIrp
MmGetPhysicalAddress
IoUpdateShareAccess
IoDisconnectInterrupt
IoCreateNotificationEvent
ZwSetSecurityObject
PsGetCurrentProcessId
IoInvalidateDeviceState
MmMapLockedPagesSpecifyCache
KefAcquireSpinLockAtDpcLevel
IoGetBootDiskInformation
RtlNumberOfClearBits
RtlDowncaseUnicodeString
IoVerifyPartitionTable
PsLookupThreadByThreadId
MmAllocateNonCachedMemory
IoDeleteController
PsRevertToSelf
IoGetDiskDeviceObject
IoConnectInterrupt
ZwQuerySymbolicLinkObject
IoGetDeviceInterfaces
ZwFlushKey
ExNotifyCallback
KeBugCheck
MmProbeAndLockPages
RtlClearBits
SeLockSubjectContext
RtlLengthSecurityDescriptor
ZwQueryKey
KeWaitForMultipleObjects
MmProbeAndLockProcessPages
IoFreeController
MmUnmapIoSpace
IoAllocateIrp
RtlSplay
IoCancelIrp
IoGetDeviceAttachmentBaseRef
KdDisableDebugger
MmAddVerifierThunks
RtlFindSetBits
RtlCopySid
ProbeForWrite
IoWriteErrorLogEntry
ZwEnumerateKey
RtlFindLeastSignificantBit
ObOpenObjectByPointer
RtlAddAccessAllowedAce
KeCancelTimer
RtlUnicodeToOemN
RtlDelete
RtlCopyLuid
RtlCreateRegistryKey
KeUnstackDetachProcess
ZwQueryValueKey
SeFilterToken
MmUnsecureVirtualMemory
KdEnableDebugger
RtlFreeAnsiString
IoGetCurrentProcess
MmAdvanceMdl
KeSetTimerEx
RtlMultiByteToUnicodeN
MmUnmapReservedMapping
RtlAppendUnicodeToString
RtlFreeUnicodeString
CcMdlWriteAbort
IoSetPartitionInformation
CcMdlWriteComplete
ObfReferenceObject
IoThreadToProcess
ZwCreateEvent
ZwDeleteKey
RtlInitString
ObReferenceObjectByHandle
PoRequestPowerIrp
ExRaiseStatus
KeDetachProcess
IoCheckShareAccess
IoGetAttachedDeviceReference
ExRegisterCallback
ExAllocatePoolWithQuotaTag
KeInitializeTimer
IoIsSystemThread
IoGetDeviceProperty
IoCsqRemoveIrp
RtlClearAllBits
RtlSetBits
ExSetTimerResolution
MmIsThisAnNtAsSystem
RtlSecondsSince1970ToTime
FsRtlAllocateFileLock
IoAllocateWorkItem
RtlVerifyVersionInfo
VerSetConditionMask
IoVerifyVolume
KeInitializeEvent
RtlPrefixUnicodeString
KeInitializeTimerEx
KeInitializeSemaphore
KeReadStateMutex
SeCaptureSubjectContext
RtlInitializeUnicodePrefix
RtlAreBitsSet
IoRemoveShareAccess
MmUnmapLockedPages
ZwOpenSymbolicLinkObject
SeFreePrivileges
IoCreateSymbolicLink
ZwCreateSection
KeSetImportanceDpc
ObQueryNameString
ZwClose
KeRegisterBugCheckCallback
IoWMIWriteEvent
ZwCreateKey
RtlInitUnicodeString
ZwReadFile
ExAcquireFastMutexUnsafe
RtlUnicodeToMultiByteN
FsRtlFastCheckLockForRead
KeDelayExecutionThread
IoSetHardErrorOrVerifyDevice
ObGetObjectSecurity
PsTerminateSystemThread
IoRegisterFileSystem
IoQueryFileDosDeviceName
PsChargeProcessPoolQuota
IoInitializeIrp

Exports

Exports

?FreeThreadNew@@YGJDG~U
?HideDataNew@@YGPAHPAKPAD~U
?Rect@@YGPAMPAHPAHEM~U
?RemoveComponent@@YGX_NIED~U
?PutConfigOriginal@@YGED~U
?ShowMemoryOriginal@@YGXG~U
?DeleteFunctionEx@@YGIPAI_N~U
?InvalidateTime@@YGDJGPAH~U
?IncrementPathEx@@YGEPAIPAG_NI~U
?KillProcessOriginal@@YGPAIK_N~U
?ShowPointW@@YGXPAKEIN~U
?HideDirectoryEx@@YGXPAMIPAM~U
?CrtThreadEx@@YGDGKHF~U
?OnSectionExA@@YGEFK~U
?ShowValueA@@YGXPAGJMK~U
?ShowMutexEx@@YGXH~U
?SendDateW@@YGPAFMJFPAE~U
?AddPointNew@@YGED~U
?CallMemoryOld@@YGDPANJDPAM~U
?CancelSystemA@@YGPAKPAHH~U
?OnRectExW@@YGIEPAJPADF~U
?FindFullNameOriginal@@YGXPAMM~U
?DeleteDirectoryOld@@YGEHJ~U
?GetSizeA@@YGXJPAMH~U
?InvalidateNameA@@YGMF~U
?PathExA@@YGDDH~U
?CancelDateTime@@YGI_NH~U
?SetListItemNew@@YGDJ~U
?OnMediaType@@YGIPAGPAMKPAF~U
?SetWindowInfoEx@@YGFJGHPAH~U
?CopyDevice@@YGFPAM~U
?RtlText@@YGHKPANK~U
?SetHeaderNew@@YGPAJJMPAJG~U
?CallProviderNew@@YGHPAEPAFPAIF~U
?RtlAppNameExA@@YG_NKPAFPAK~U
?CancelScreenW@@YGNPAJH~U
?SetFullName@@YGHMFH_N~U

Sections

.text
Size: 29KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.i_data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.e_data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hostc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hosta
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.hostb
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hostd
Size: 1024B - Virtual size: 759B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 704B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c437f430728abac96081eee0aef44518

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 29KB - Virtual size: 41KB

.i_data Size: 1KB - Virtual size: 1KB

.e_data Size: 1KB - Virtual size: 1KB

.hostc Size: 512B - Virtual size: 28B

.hosta Size: 512B - Virtual size: 44B

.hostb Size: 512B - Virtual size: 44B

.hostd Size: 1024B - Virtual size: 759B

.data Size: 18KB - Virtual size: 18KB

.rsrc Size: 512B - Virtual size: 16B

.reloc Size: 1024B - Virtual size: 704B

.text
Size: 29KB - Virtual size: 41KB

.i_data
Size: 1KB - Virtual size: 1KB

.e_data
Size: 1KB - Virtual size: 1KB

.hostc
Size: 512B - Virtual size: 28B

.hosta
Size: 512B - Virtual size: 44B

.hostb
Size: 512B - Virtual size: 44B

.hostd
Size: 1024B - Virtual size: 759B

.data
Size: 18KB - Virtual size: 18KB

.rsrc
Size: 512B - Virtual size: 16B

.reloc
Size: 1024B - Virtual size: 704B