5a25ba967326f9915c0de5d5ad12b2cd_JaffaCakes118

General

Target

5a25ba967326f9915c0de5d5ad12b2cd_JaffaCakes118
Size

65KB
MD5

5a25ba967326f9915c0de5d5ad12b2cd
SHA1

79eafa0b9b82324ab905a17412c8dc52c76dd7bc
SHA256

b3ce857adf092dab242af3b5633a181c982697219e9cb2a1360be56c8f98af1b
SHA512

245c83c2da3082d6e1918dbcc326bd6e787b4d6f4510a321728d1d8f7f6bbbda6ff3d95a714468def0a0a465bffd35c9189ef869a879c58a67cb8ab5f11f4cba
SSDEEP

768:FvC0SUiHwQK1uL4ju5NE/CwPdqrubifEaHBRAy21JnaEN9clXFwjzAqUho423ym/:FKJUIYY4y5yCiM6bVclVUjfQxklE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5a25ba967326f9915c0de5d5ad12b2cd_JaffaCakes118

Files

5a25ba967326f9915c0de5d5ad12b2cd_JaffaCakes118
.dll windows:5 windows x86 arch:x86

894ead0904a546f5877584bf3af307be

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

S:\ysudPrGif\CigGsiCsefoeg\spzlrllX.pdb

Imports

ntoskrnl.exe

IoGetTopLevelIrp
CcMapData
ExGetPreviousMode
IoGetDeviceProperty
PsCreateSystemThread
FsRtlNotifyUninitializeSync
RtlWriteRegistryValue
ObCreateObject
KeTickCount
KeEnterCriticalRegion
ZwReadFile
FsRtlIsFatDbcsLegal
IoBuildSynchronousFsdRequest
IoVerifyPartitionTable
ExRegisterCallback
KeInitializeSemaphore
SeLockSubjectContext
RtlAnsiStringToUnicodeString
RtlFindNextForwardRunClear
RtlCreateAcl
IoStartPacket
RtlGetVersion
KeSetBasePriorityThread
ExSetTimerResolution
ExRaiseAccessViolation
MmIsVerifierEnabled
SeCaptureSubjectContext
RtlCreateSecurityDescriptor
KeGetCurrentThread
CcFlushCache
IoBuildPartialMdl
KeInitializeQueue
ObReleaseObjectSecurity
ZwDeleteValueKey
FsRtlFastUnlockSingle
KeInitializeDpc
KeSetTargetProcessorDpc
KeLeaveCriticalRegion
MmUnmapReservedMapping
KeInitializeSpinLock
KeDelayExecutionThread
IoReleaseVpbSpinLock
IoDeleteDevice
ObReferenceObjectByHandle
ExDeleteResourceLite
MmMapLockedPagesSpecifyCache
ExAllocatePoolWithTag

Exports

Exports

?PutListExW@@YGPAIEH_N<V
?CallVersionOld@@YGPA_NPAHPAD<V
?FreeKeyboardA@@YGIPAJ<V
?DeleteFolderPath@@YGPAKGM_N<V
?IsDateTimeW@@YG_NJF<V
?InsertTextExA@@YGFKE<V

Sections

.text
Size: 64KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

894ead0904a546f5877584bf3af307be

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 64KB - Virtual size: 85KB

.text
Size: 64KB - Virtual size: 85KB