384baa6e016f4b862358658351b09c73_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

384baa6e016f4b862358658351b09c73_JaffaCakes118
Size

134KB
MD5

384baa6e016f4b862358658351b09c73
SHA1

67a7916e48a1f9f9b1275a747a2dfbf136a6577c
SHA256

4a81a383f09fe9d126c7661396151f5dc71577262bad9516ffcfcfcd9a01e131
SHA512

8b5cb55ead1df4b7ec00792c23666241cae1c8e0118887b418997ff875650d307afb3bcb55d404a7a4c8861d842cb96a9749887839658e6abc205b196d9b1fb3
SSDEEP

3072:xsKDbWGA/l623+JsrVn/I0v91bGjPf2od9kJ1i9Q3D0MA9DQf:xtOGA/J3+JsrVnbv9YD2TJ1i9CDDA9s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
384baa6e016f4b862358658351b09c73_JaffaCakes118

Files

384baa6e016f4b862358658351b09c73_JaffaCakes118
.dll windows:1 windows x86 arch:x86

492123cab442833428a349e62224788c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

KeBugCheckEx
DbgPrint
RtlAnsiCharToUnicodeChar
IoGetCurrentProcess
KeQueryTimeIncrement
_except_handler3
strncmp
ObReferenceObjectByHandle
ExInterlockedPopEntrySList
MmMapLockedPagesSpecifyCache
ZwQuerySystemInformation
MmLockPagableImageSection
CcPurgeCacheSection
ExFreePoolWithTag
wcsncpy
strstr
RtlClearAllBits
ExAllocatePoolWithTag
RtlSubtreePredecessor
_vsnprintf
PsGetJobUIRestrictionsClass
ObReleaseObjectSecurity
strncpy
KeTickCount
ObfReferenceObject

Sections

.data
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 640B - Virtual size: 639B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 800B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 192B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE