5d65275de3df1107077b1aad71568313_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5d65275de3df1107077b1aad71568313_JaffaCakes118
Size

73KB
MD5

5d65275de3df1107077b1aad71568313
SHA1

cd38c7e40aef876f9422ecbc69f5ac8ee412362a
SHA256

fb8e95cacf01adb39a212cb863b9bf2ee4bc7ea31b58151bf39a045e2571d726
SHA512

7b3dc443dace3f60bee78a406b8b212089f687ca67ee4748f80392f71693c0ab774f1d26d9aabf0c7d93de8f3f6b6af69769fe18b6ae449d955080939e30c147
SSDEEP

1536:FQe3zR8C3C15HU5NUHJlsvQ0h95dGGkIU7dJU4xCgXrfjvpQkYBgUD:LhwF8N8IJ95fkZx8gX7jvpQk8gU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5d65275de3df1107077b1aad71568313_JaffaCakes118

Files

5d65275de3df1107077b1aad71568313_JaffaCakes118
.dll windows:4 windows x86 arch:x86

c7fc7e855f2bff1a4fbe36f40f2bdb2a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

PsGetCurrentThreadId
FsRtlDeleteKeyFromTunnelCache
IoSetHardErrorOrVerifyDevice
RtlExtendedIntegerMultiply
RtlLargeIntegerShiftRight
IoReportTargetDeviceChangeAsynchronous
IoReportResourceUsage
RtlDestroyAtomTable
MmUnmapLockedPages
RtlInitializeRangeList
KiAcquireSpinLock
SeSinglePrivilegeCheck

Sections

CODE
Size: 3KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 426B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 58B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ