4d96cf17ae21bb93ca87cb2c3f4071f0_JaffaCakes118 | Triage

Sharing

General

Target

4d96cf17ae21bb93ca87cb2c3f4071f0_JaffaCakes118
Size

4KB
MD5

4d96cf17ae21bb93ca87cb2c3f4071f0
SHA1

f5447043de09502bc1ec1ebb5c217740ad2955a6
SHA256

00ef51ccad4433f036e6d719aa37478b16dab60aad9c2836767130d4d3591314
SHA512

f5f19e9e15b48ab4efd262cb2dd1766b5803a0d2ab941625a1c48827e4126efe4244d11114a22c4952cf4d72003d9f8ed9e954ec47da3bbd7c311d86f29e4765

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d96cf17ae21bb93ca87cb2c3f4071f0_JaffaCakes118

Files

4d96cf17ae21bb93ca87cb2c3f4071f0_JaffaCakes118
.dll windows:4 windows x86 arch:x86

084d5253a6e9b0d181b8f7c9ec09f4fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

IofCompleteRequest
ZwClose
ZwUnmapViewOfSection
ExAllocatePoolWithTag
ZwMapViewOfSection
ZwOpenSection
RtlInitUnicodeString
memcpy
ObfDereferenceObject
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsLookupProcessByProcessId
PsSetCreateProcessNotifyRoutine

Sections

.text
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 516B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ