5deffe327dc90f636b474afed9196c6b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5deffe327dc90f636b474afed9196c6b_JaffaCakes118
Size

134KB
MD5

5deffe327dc90f636b474afed9196c6b
SHA1

4de704a0b71e72aaa179fcaac037e0a0e4f3ebbf
SHA256

f3893d1d8d65fcebb4259a70f959a68b634f96176927e462f31c6c1aa5b5f79e
SHA512

ac826acf7bfb8b9cde9401e543c89dc4d5c4574974d8eafde3cc9de7c402e69debd75f94fc52adf00140b67b6afbb233b2d071759eb266d37473f8a749f3619e
SSDEEP

3072:3YfK4MkJKqgmgVzDPDjIa4L0/E1JoWoiyQ562PGEo6cGL6G:oVKrVzDPDj4l10o6WS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5deffe327dc90f636b474afed9196c6b_JaffaCakes118

Files

5deffe327dc90f636b474afed9196c6b_JaffaCakes118
.dll windows:1 windows x86 arch:x86

48ae17906beb01648d53c6337cfadc5a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

wcsncpy
ObReferenceObjectByHandle
strstr
ZwQuerySystemInformation
RtlSetAllBits
InitSafeBootMode
KeTickCount
IoGetCurrentProcess
PsSetContextThread
ZwQueryDefaultUILanguage
KeQueryTimeIncrement
MmMapLockedPagesSpecifyCache
ObfReferenceObject
MmGrowKernelStack
strncpy
ExFreePoolWithTag
_except_handler3
RtlAnsiCharToUnicodeChar
FsRtlBalanceReads
RtlInitAnsiString
ExAllocatePoolWithTag
FsRtlLegalAnsiCharacterArray
DbgPrint
KeBugCheckEx
strncmp

Sections

.data
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 640B - Virtual size: 635B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 800B - Virtual size: 770B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 192B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE