3976eae6cbf72451e25b2c325b46ea2c_JaffaCakes118 | Triage

Sharing

General

Target

3976eae6cbf72451e25b2c325b46ea2c_JaffaCakes118
Size

129KB
MD5

3976eae6cbf72451e25b2c325b46ea2c
SHA1

5a1726dffc60d0f1bfb6112f003f471c7794201b
SHA256

d5a7b5a78bdfca611ad42533ee267c7c03edadcc5ab835a6d2ac8d67f8bf3c06
SHA512

df96141d80fa3ecffa0d699c2cc86beee1d360a5f15d7b63b0d52cf5fe545b27b20cf40671c54fa91c675e98ec1d6e99b2e80d741dd02ea7dc46c16d9fcfee21
SSDEEP

3072:8Hag75zJidv3JAT4oU8/qRBnfPgxoPhJmZDYxR:86g8v3E/qRBfgo5JmZDYxR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3976eae6cbf72451e25b2c325b46ea2c_JaffaCakes118

Files

3976eae6cbf72451e25b2c325b46ea2c_JaffaCakes118
.dll windows:1 windows x86 arch:x86

dea58ea82c16acbf048637161ce63c50

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

IoGetCurrentProcess
strncmp
FsRtlAllocateResource
wcsncpy
_except_handler3
KeTickCount
KeQueryTimeIncrement
NtOpenProcess
ObfReferenceObject
ZwSetEaFile
KeBugCheckEx
ExFreePoolWithTag
KeSetTargetProcessorDpc
ExAllocatePoolWithTag
ExQueueWorkItem
MmFlushImageSection
IoReadDiskSignature
ZwQuerySystemInformation
DbgPrint
IoInitializeRemoveLockEx
strncpy
ObReferenceObjectByHandle
strstr
MmMapLockedPagesSpecifyCache
RtlAnsiCharToUnicodeChar

Sections

.data
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 672B - Virtual size: 642B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 768B - Virtual size: 762B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 192B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE