5b8dc1851a3b5fc1a49c9964e93e3d9d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5b8dc1851a3b5fc1a49c9964e93e3d9d_JaffaCakes118
Size

134KB
MD5

5b8dc1851a3b5fc1a49c9964e93e3d9d
SHA1

29a7b640a278c41edcc7956192986a5fd25a7801
SHA256

911ca9cf395e21a4cf8d43aa7d1c3b504082dd2621050fa1147456a1eaa1d994
SHA512

1535f0bd7a0f443defd59ef4ed08ba3cfcf3df56b9a021cf68cc5045d2fef67302315caf27d074ee06a888792cac1870523ecb84299cc4c25b16e0bb952c4873
SSDEEP

3072:hjsoE9uSU7Gfmgzs0iy2ses58CJ8GZnhj7qKAAob1:JstujifmrG2F48GRhtJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b8dc1851a3b5fc1a49c9964e93e3d9d_JaffaCakes118

Files

5b8dc1851a3b5fc1a49c9964e93e3d9d_JaffaCakes118
.dll windows:1 windows x86 arch:x86

8bcbb0c9f5aa681d5eb7c36dc87fea0f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

_except_handler3
ZwQuerySystemInformation
wcsncpy
MmMapLockedPagesSpecifyCache
KeBugCheckEx
ZwSetInformationFile
ObReferenceObjectByHandle
FsRtlAllocatePoolWithTag
RtlGUIDFromString
RtlAnsiCharToUnicodeChar
KeTickCount
KeRemoveSystemServiceTable
IoFileObjectType
strstr
InbvIsBootDriverInstalled
ExFreePoolWithTag
IoConnectInterrupt
NtWriteFile
DbgPrint
IoGetCurrentProcess
strncpy
KeQueryTimeIncrement
ObfReferenceObject
ExAllocatePoolWithTag
strncmp

Sections

.data
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 672B - Virtual size: 642B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 800B - Virtual size: 778B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 192B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE