45b2727b6ea9279052746c87d02e2e9c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

45b2727b6ea9279052746c87d02e2e9c_JaffaCakes118
Size

73KB
MD5

45b2727b6ea9279052746c87d02e2e9c
SHA1

21524947f02f4c7cf9b308bb1790926b5d180a22
SHA256

378e3f7c1c94624aa4c5acceb890c1ad8af3546ac55bb50a96da5d7336ede4f3
SHA512

6a140816d65303d8fcd36f3aeb0fc1920e28813a8565d76822cf2ef198481f8073f08f7e250f71ac07c828be8e21b686d29a4ec55a14f874f5e59a003adffe65
SSDEEP

1536:FulOBVZ9KUhg7SsJy3wEYOVW2F0ZBUB+hklUJ1MqfEtWdgP:wIiYtFF0ZiUheULM1tWdI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
45b2727b6ea9279052746c87d02e2e9c_JaffaCakes118

Files

45b2727b6ea9279052746c87d02e2e9c_JaffaCakes118
.dll windows:4 windows x86 arch:x86

ff34637fdaf03f5bfeb6e4b27ab52e6b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

READ_REGISTER_USHORT
KeSetImportanceDpc
RtlPrefixString
IoReleaseRemoveLockEx
FsRtlInitializeMcb
IoCreateSymbolicLink
RtlAddRange
IoAllocateWorkItem
RtlDestroyHeap
KeRevertToUserAffinityThread

Sections

CODE
Size: 3KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 310B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 94B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ