38ece69c83d42acdb6211cc8015ced90_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

38ece69c83d42acdb6211cc8015ced90_JaffaCakes118
Size

3KB
MD5

38ece69c83d42acdb6211cc8015ced90
SHA1

e112f744b6b259ccec0fb22a56a28ff00a82e9e0
SHA256

482d56969e1cc4b8b50240d5eaa425caaee6251f4c7a67f91e9438be145cd754
SHA512

8c14f16044913905248f18e993428c4ada73227897448c73e593e69c4516ddd2d03af045fdefe10a9b38d6bd8f888ffc713cff00f093af8e0a0f6e39c750326d

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
38ece69c83d42acdb6211cc8015ced90_JaffaCakes118

Files

38ece69c83d42acdb6211cc8015ced90_JaffaCakes118
.dll windows:5 windows x86 arch:x86

9cdf4a89965f45e2d3770fa763a47517

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

FsRtlAllocatePool
ZwDeviceIoControlFile
ZwClose
ObfDereferenceObject
ObReferenceObjectByHandle
IoFileObjectType
ZwOpenFile
IoRegisterPlugPlayNotification
IoCreateDriver
PsSetCreateThreadNotifyRoutine

Exports

Exports

KdD0Transition
KdD3Transition
KdDebuggerInitialize0
KdDebuggerInitialize1
KdReceivePacket
KdRestore
KdSave
KdSendPacket

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 62B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ