4352b804166eab7304d987ecccee56c3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4352b804166eab7304d987ecccee56c3_JaffaCakes118
Size

134KB
MD5

4352b804166eab7304d987ecccee56c3
SHA1

a0950f8a0c2c9c15f5cade040cf0356ee70d8de6
SHA256

5c213e31eb22787e6516ae7cccad633af8c86c9734edf447982521bbf26968a7
SHA512

c26a28db1338cf02b75a7898a3ef04e4e721f2135d84ae378a701c3ba86e384128da897f63468ddb9271b3b2fe37b0f4be8b1d7263c531e487d8e8801e44268a
SSDEEP

3072:gyrNFvgrGQ9KWBOa6O/r0RYIrkKPHBeHxeG5cGo8PVDT:gkNjVVaZwJAKPHoXVVD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4352b804166eab7304d987ecccee56c3_JaffaCakes118

Files

4352b804166eab7304d987ecccee56c3_JaffaCakes118
.dll windows:1 windows x86 arch:x86

54cda1c383cc07f0669faa4bcb0c0555

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

ObReferenceObjectByHandle
ExAllocatePoolWithTag
DbgPrint
wcsncpy
RtlAnsiCharToUnicodeChar
KeInitializeApc
IoGetCurrentProcess
ExFreePoolWithTag
PsSetContextThread
SeFilterToken
strstr
MmMapLockedPagesSpecifyCache
_except_handler3
MmUnmapVideoDisplay
IoWMIQueryAllData
ObfReferenceObject
KeEnterKernelDebugger
KeQueryRuntimeThread
PsGetCurrentProcessSessionId
KeBugCheckEx
ZwQuerySystemInformation
strncmp
KeTickCount
strncpy
KeQueryTimeIncrement

Sections

.data
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 640B - Virtual size: 639B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 800B - Virtual size: 770B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 192B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE