40ba7ab2ba85d5fa7404ee99bbdd6f69_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

40ba7ab2ba85d5fa7404ee99bbdd6f69_JaffaCakes118
Size

5KB
MD5

40ba7ab2ba85d5fa7404ee99bbdd6f69
SHA1

5da2bb2893526c5b40ab2c8dfe90656be98661f3
SHA256

c562d2d6f8dfa43503e311143183e7f9abd91c98a6ecbeeb5c6616ba80d9d976
SHA512

864abcf67f921788b821cf582220dc8bec0b4c6abbb8da58d8ec64e116a37c6b9504f69fd6c36f003563001df854373a2e3ca0e1ebe9d031b6f287b6f255ab7c
SSDEEP

48:SH1Q9QxTzJw7QnO8y2rPxTT/daOkBPAXCU365Lqwy1hnYOJ4xI6AlHFfXV0Lcyt:GW7Qb5zx/MBWwy/nVW7A3+Lcyt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40ba7ab2ba85d5fa7404ee99bbdd6f69_JaffaCakes118

Files

40ba7ab2ba85d5fa7404ee99bbdd6f69_JaffaCakes118
.dll windows:5 windows x86 arch:x86

2586d3a8b8e9ca45ba073a97749a646a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\VC5\release\fd.pdb

Imports

ntoskrnl.exe

memcpy
ExFreePoolWithTag
memset
ExAllocatePool
KeInitializeEvent
KeEnterCriticalRegion
ExAcquireFastMutexUnsafe
ExReleaseFastMutexUnsafe
KeLeaveCriticalRegion
RtlCompareUnicodeString
RtlInsertElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlInitializeGenericTableAvl
CcInitializeCacheMap
MmMapLockedPagesSpecifyCache
ExGetPreviousMode
ProbeForWrite
ProbeForRead
CcPurgeCacheSection
CcUninitializeCacheMap
IofCompleteRequest
IoDeleteDevice
IoCreateDevice
_except_handler3

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ