435505835808903ffea4a3df4ae8b9bb_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

435505835808903ffea4a3df4ae8b9bb_JaffaCakes118
Size

45KB
MD5

435505835808903ffea4a3df4ae8b9bb
SHA1

161756e9a3c40e01a6989f5e6b1e234359eff901
SHA256

4fa32f1fa9cb8b5485be1f551762632b32ef0fd754af341d2665bfbd80bce85c
SHA512

9007283528658caf8d58a7eb95bfd461afe9981cf98a3e061475cbea64d94d5fdc9c9971fc5ae7aec7ed519784389d50dd61660d399ade23d30b47bae16a6090
SSDEEP

768:EJl1fH2uuyRNbHGJNkpnY3z1zYvRmonSQGIpWkICupN:eltH2uRLYm1YhzkRVP4p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
435505835808903ffea4a3df4ae8b9bb_JaffaCakes118

Files

435505835808903ffea4a3df4ae8b9bb_JaffaCakes118
.dll windows:5 windows x86 arch:x86

e071e820933c9177fa33ca10d04a9e23

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

T:\esuD\FzFqQ\mdnHsgG.pdb

Imports

ntoskrnl.exe

RtlEqualUnicodeString
PsLookupThreadByThreadId
FsRtlIsNameInExpression
ObReferenceObjectByHandle
KeInsertByKeyDeviceQueue
KeSynchronizeExecution
RtlCompareString
KeRemoveQueueDpc
RtlInitString
ZwClose
ExReinitializeResourceLite
MmSizeOfMdl
KeStackAttachProcess
IoIsSystemThread
KeSetPriorityThread
ExAllocatePoolWithQuotaTag
IoRegisterDeviceInterface
KeInitializeQueue
SeCreateClientSecurity
KeSetEvent
RtlEqualString
RtlGetNextRange
RtlCreateUnicodeString
CcFastCopyWrite
ExRaiseDatatypeMisalignment

Exports

Exports

?FysztJehnkkDeHmqmJKa@@YGPAXPAHPA_N@Z

Sections

.text
Size: 17KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ