44bedd3b1348cb9a390c9f4e1d532a07_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

44bedd3b1348cb9a390c9f4e1d532a07_JaffaCakes118
Size

134KB
MD5

44bedd3b1348cb9a390c9f4e1d532a07
SHA1

1f9ff7518bfe4ce611ceb1c185328bb936bf310b
SHA256

9e0125ef91e88430f2ee5ca4e61ac8017a3897571497ceab96773ab50f625944
SHA512

eda13362e41e95aa0d082dbad9685ac2f03e0c9232850f7f9a04cb9460969dbbadc8a65482b7afbff7e40ffe3ba63016b9022cf087a54fe31a8e7e7c39feaa25
SSDEEP

3072:cHxXoLyCNpTTvkkvdeFoTDRwkn4bs/Q700a0jI3gLflL9WYLx13:caxVzkQ8iT2k4Q/Qc0jegLflL9vV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44bedd3b1348cb9a390c9f4e1d532a07_JaffaCakes118

Files

44bedd3b1348cb9a390c9f4e1d532a07_JaffaCakes118
.dll windows:1 windows x86 arch:x86

599af0c9389cb692b69e26fe8984b59a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

VerSetConditionMask
_aulldiv
ObfReferenceObject
ExFreePoolWithTag
DbgPrint
KeLeaveCriticalRegion
RtlUnicodeStringToAnsiSize
RtlAnsiCharToUnicodeChar
ZwQueryDirectoryFile
strstr
ExAllocatePoolWithTag
KeBugCheckEx
ObReferenceObjectByHandle
KeTickCount
MmForceSectionClosed
wcsncpy
_except_handler3
strncmp
ZwQuerySystemInformation
ExEnumHandleTable
IoGetCurrentProcess
wcscmp
strncpy
MmMapLockedPagesSpecifyCache
KeQueryTimeIncrement

Sections

.data
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 640B - Virtual size: 633B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 768B - Virtual size: 758B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 192B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE