5ac0d5af604cf82404983d94669229cb_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5ac0d5af604cf82404983d94669229cb_JaffaCakes118
Size

6KB
MD5

5ac0d5af604cf82404983d94669229cb
SHA1

fe4e7980469d0e0c7209df7053b536df365c3fb5
SHA256

0d05671d4f55a59bc721e2efee92271950477a884128b1dccfe4e4f8e7af3a7c
SHA512

801922bca4853c42f7c193f8e4e09a154868f66dff8535e82eedc2c35251623582173dbd25d7ddc7ab64a27bae5d69f4c6a53ee8bbe15aec11d8a18fd451ca84
SSDEEP

96:otjvzn4uDXNYGmMOClDvprii1pGAph1u2O/:wxNOQoG1M/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5ac0d5af604cf82404983d94669229cb_JaffaCakes118

Files

5ac0d5af604cf82404983d94669229cb_JaffaCakes118
.dll windows:4 windows x86 arch:x86

3f32496dbc6dd744dfaa617a9cd2ae34

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

NtCreateFile
RtlInitUnicodeString
ZwQueryInformationFile
memcpy
memset
ExAllocatePool
ZwMapViewOfSection
ZwClose
ZwCreateSection
_stricmp
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwUnmapViewOfSection
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
strcat
strrchr
strcpy
ZwQuerySystemInformation
NtBuildNumber

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 202B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 526B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ