4269bcbda7827f86dbe389b05dba8bda_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4269bcbda7827f86dbe389b05dba8bda_JaffaCakes118
Size

6KB
MD5

4269bcbda7827f86dbe389b05dba8bda
SHA1

ecd560dc0da013cdee39778b5adcdb6cbe8685d2
SHA256

ad176598a6f1e3350878b9b2e5af4cb6d5ead9745d12cae5e94a50ea2b3e0321
SHA512

4197bb4a5da76f0a919a737e982512fc3e1b3d52bb19bcbf5e3bba5a31ac429a24370b6c9b33544a098ec7dfbb114b8c9ec783e39017b8e49410aaee141bf1e5
SSDEEP

96:XGWapzKeuD3GOnWDfRRvmF9prii1pGAph1u21:2IjI4hoG1P

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4269bcbda7827f86dbe389b05dba8bda_JaffaCakes118

Files

4269bcbda7827f86dbe389b05dba8bda_JaffaCakes118
.dll windows:4 windows x86 arch:x86

3f32496dbc6dd744dfaa617a9cd2ae34

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

NtCreateFile
RtlInitUnicodeString
ZwQueryInformationFile
memcpy
memset
ExAllocatePool
ZwMapViewOfSection
ZwClose
ZwCreateSection
_stricmp
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwUnmapViewOfSection
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
strcat
strrchr
strcpy
ZwQuerySystemInformation
NtBuildNumber

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 202B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 526B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ