60934c1ec83e2bd839f97d25b4ff1dd8_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

60934c1ec83e2bd839f97d25b4ff1dd8_JaffaCakes118
Size

610KB
MD5

60934c1ec83e2bd839f97d25b4ff1dd8
SHA1

3e46a0301ba6a8885b9ccd26e8c4d1e6378bf930
SHA256

3c9b959b2a4ba39266ed128caa0fe537128ec2952a7ecdffc46c09caf915f7da
SHA512

12b10a6d1e5f12ef41e9cde5db7fc3a6639dc26788d2fbccf43a2284a9e145e886fb21914129995ffecb3a1c9168bc74319d4e297f6f7902f15fd56663a529ad
SSDEEP

12288:FqnXcZolApjncBflu9oP8ml0qWPbXtIE2N/XDOWvpTh:FqnsSAxcBfIBml0qWb93mvpTh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
60934c1ec83e2bd839f97d25b4ff1dd8_JaffaCakes118

Files

60934c1ec83e2bd839f97d25b4ff1dd8_JaffaCakes118
.dll windows:5 windows x86 arch:x86

ed0e06ff90b5615c119010a40514ec78

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

ZwOpenFile
ZwCreateSection
ZwMapViewOfSection
ZwClose
ZwUnmapViewOfSection
ExAllocatePool
ExFreePoolWithTag
RtlIpv4AddressToStringA
KeQueryInterruptTime
ZwQueryDirectoryFile
RtlTimeToTimeFields
RtlUnicodeStringToInteger
RtlTimeToSecondsSince1970
ZwDeviceIoControlFile
ExUuidCreate
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
swprintf
RtlInitUnicodeString
ZwWriteFile
RtlSecondsSince1970ToTime
ZwCreateFile
RtlRandom
KeEnterCriticalRegion
ExAcquireFastMutexUnsafe
ExReleaseFastMutexUnsafe
KeLeaveCriticalRegion
KeQuerySystemTime
KeInsertQueue
KeRemoveQueue
KeRundownQueue
IoFreeIrp
KeInitializeQueue
ObfReferenceObject
PsCreateSystemThread
ObReferenceObjectByHandle
IoBuildDeviceIoControlRequest
IofCallDriver
KeInitializeTimer
KeInitializeDpc
qsort
KeCancelTimer
ExQueueWorkItem
ZwQueryValueKey
RtlIpv4StringToAddressW
ZwOpenKey
ZwEnumerateKey
ZwOpenSection
MmAllocatePagesForMdl
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmFreePagesFromMdl
RtlHashUnicodeString
KeSetEvent
RtlPrefixUnicodeString
IoGetRelatedDeviceObject
IoAllocateIrp
KeInitializeEvent
KeWaitForSingleObject
ExAllocatePoolWithTag
ZwDeleteKey
PoStartNextPowerIrp
IofCompleteRequest
PoCallDriver
ObReferenceObjectByName
IoDriverObjectType
IoEnumerateDeviceObjectList
IoCreateDevice
ZwFlushVirtualMemory
ZwQueryKey
IoQueueWorkItem
ZwLoadDriver
ObMakeTemporaryObject
ZwFsControlFile
IoDeleteDevice
ZwSetSystemInformation
ZwDeleteFile
IoCreateDriver
wcsrchr
IoRegisterShutdownNotification
IoAllocateWorkItem
KeSetTimerEx
KeSetTimer
ObfDereferenceObject
_allmul
_allshr
memset
_aulldiv
memcpy

hal

KeGetCurrentIrql

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ed0e06ff90b5615c119010a40514ec78

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 19KB - Virtual size: 19KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 2KB - Virtual size: 2KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 19KB - Virtual size: 19KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1KB - Virtual size: 1KB