5b4e95bac2a30e86b7de558677ae5f16_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5b4e95bac2a30e86b7de558677ae5f16_JaffaCakes118
Size

132KB
MD5

5b4e95bac2a30e86b7de558677ae5f16
SHA1

e8bbdfbcc1b453378d69b2bacf30cb30cd14cf82
SHA256

a14be08d295d696a8e3013a0439de07219657f7ef804480daba7c2b059473672
SHA512

75a34808de6fc7622285171cef1b2e6e0738c0b0d7602aebdabb131f8725568dc3438c7e7e0d49f28b323a51e6d387d2ce89f559ea6618d18e00b3519e36de89
SSDEEP

3072:S1f097HIvausEbs5PoA31sFDGB+dRw5hjORHgl3z8KvK:S10hIiuDbs2AOY+Tw5hoAlR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b4e95bac2a30e86b7de558677ae5f16_JaffaCakes118

Files

5b4e95bac2a30e86b7de558677ae5f16_JaffaCakes118
.dll windows:1 windows x86 arch:x86

dcb44b20c6097ae37d5e5d15245aa2d3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

strncpy
IoGetDmaAdapter
FsRtlInitializeMcb
ObReferenceObjectByHandle
IoGetCurrentProcess
PsSetProcessWin32Process
KeQueryTimeIncrement
_except_handler3
KeTickCount
KeBugCheckEx
SeDeleteObjectAuditAlarm
RtlIsNameLegalDOS8Dot3
ExFreePoolWithTag
ObfReferenceObject
strncmp
ZwQuerySystemInformation
wcsncpy
RtlZeroMemory
MmMapLockedPagesSpecifyCache
RtlIpv4AddressToStringW
strstr
RtlAnsiCharToUnicodeChar
DbgPrint
IoWMISetSingleInstance
ExAllocatePoolWithTag

Sections

.data
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 640B - Virtual size: 619B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 800B - Virtual size: 782B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 192B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE