6327e32592715d9e0aeeabbf0d77417f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6327e32592715d9e0aeeabbf0d77417f_JaffaCakes118
Size

64KB
MD5

6327e32592715d9e0aeeabbf0d77417f
SHA1

7124b98518a490afeb2cd407de0edd266728c332
SHA256

bca51f4288e4c24ca691d907cd1d3b0815e33eff0155b7c1aef52f7d1742abb1
SHA512

2ab8d039585b2457bab56454c2b731947e242510c34329727af596163d1e705f651bde87117af725dbd002bfb80f7efbab858a00b52d45121cfef7fea49056bd
SSDEEP

768:Nbeg/9D5189uddyTBpWqPoQpF0IoUMjxDpFsdJsDdWM+8O0s63esjH/AppT:NSCDr89u6xLvGD8dJsDu81D3esjH/A/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6327e32592715d9e0aeeabbf0d77417f_JaffaCakes118

Files

6327e32592715d9e0aeeabbf0d77417f_JaffaCakes118
.dll windows:5 windows x86 arch:x86

fe8045b51fe53e535ce916022898baf7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\egzaasGbi\ugpsgdurbvlqgt\buvhzjW.pdb

Imports

ntoskrnl.exe

CcGetFileObjectFromBcb
ExUuidCreate
RtlInitializeSid
CcPreparePinWrite
RtlCompareUnicodeString
RtlxOemStringToUnicodeSize
RtlOemToUnicodeN
FsRtlCheckOplock
SeAppendPrivileges
KeWaitForMultipleObjects
KeStackAttachProcess
RtlIntegerToUnicodeString
IoReadPartitionTableEx
SeUnlockSubjectContext
ZwPowerInformation
WmiQueryTraceInformation
SeDeleteObjectAuditAlarm
PsGetProcessId
SeLockSubjectContext
ObReferenceObjectByHandle
ObQueryNameString
IoSetPartitionInformationEx
IoInvalidateDeviceState
IoCheckQuotaBufferValidity
RtlDowncaseUnicodeString
CcUnpinDataForThread
MmMapLockedPages
RtlCopyLuid
CcSetFileSizes
RtlFindLeastSignificantBit
SeFilterToken
KeSetTargetProcessorDpc
ZwCreateFile
CcPurgeCacheSection
RtlEqualUnicodeString
IoWMIWriteEvent
KeResetEvent
RtlNtStatusToDosError
IoFreeIrp
RtlAppendUnicodeToString
IoStartPacket
MmCanFileBeTruncated
SeTokenIsRestricted
IoReleaseRemoveLockAndWaitEx
SeImpersonateClientEx
VerSetConditionMask
ZwFlushKey
CcInitializeCacheMap
KeSynchronizeExecution
ExNotifyCallback
RtlFindUnicodePrefix
KeRemoveQueue
SeOpenObjectAuditAlarm
IoFreeErrorLogEntry
IoIsOperationSynchronous
CcMdlReadComplete
KeQueryInterruptTime
ObGetObjectSecurity
SeCreateClientSecurity
MmForceSectionClosed
ProbeForWrite
RtlCreateUnicodeString
IoWMIRegistrationControl
KeSetBasePriorityThread
CcFastCopyWrite
ExDeleteResourceLite
ZwDeviceIoControlFile
ExInitializeResourceLite
ObfDereferenceObject
PsCreateSystemThread
ZwDeleteValueKey
KeRegisterBugCheckCallback
RtlPrefixUnicodeString
PoSetSystemState
IoReportDetectedDevice
ExAllocatePoolWithTag
IoAllocateMdl
IofCallDriver
PsTerminateSystemThread
MmAllocateMappingAddress
RtlLengthSecurityDescriptor
MmUnsecureVirtualMemory
IoGetDeviceToVerify
RtlInitUnicodeString
IoReleaseVpbSpinLock
RtlLengthSid
RtlFindMostSignificantBit
ZwQueryVolumeInformationFile
RtlCompareString
DbgBreakPointWithStatus
RtlInt64ToUnicodeString
MmLockPagableDataSection
IoGetStackLimits
SeSinglePrivilegeCheck
RtlCheckRegistryKey
DbgPrompt
IoReuseIrp
IoGetDriverObjectExtension
IoStopTimer
CcSetDirtyPinnedData
RtlRemoveUnicodePrefix
KeBugCheck
KeSetTimerEx
MmProbeAndLockProcessPages
CcCopyWrite
IoGetDeviceObjectPointer
IoGetLowerDeviceObject
IoGetTopLevelIrp
IofCompleteRequest
FsRtlFreeFileLock
ExIsProcessorFeaturePresent
RtlTimeToSecondsSince1980
IoThreadToProcess
KeInitializeDpc
IoVerifyPartitionTable
RtlFreeAnsiString
PsLookupThreadByThreadId
ZwCreateSection
MmIsVerifierEnabled
PoCallDriver
RtlWriteRegistryValue
ZwCreateKey
SeQueryInformationToken
IoAllocateIrp
RtlDeleteRegistryValue
KeDeregisterBugCheckCallback
MmMapIoSpace
CcPinMappedData
IoCreateDevice
IoReleaseCancelSpinLock
RtlFreeOemString
RtlEqualSid
IoDeleteController
MmAdvanceMdl
IoDetachDevice
IoAcquireRemoveLockEx
ExUnregisterCallback
KdDisableDebugger
PsLookupProcessByProcessId
ExFreePoolWithTag
ZwOpenSymbolicLinkObject
ExGetSharedWaiterCount
RtlCopyUnicodeString
KeInsertDeviceQueue
KeReadStateMutex
ZwQuerySymbolicLinkObject
RtlSetBits
IoQueryDeviceDescription
ObCreateObject
RtlInitString
ZwQueryObject
CcPinRead
KeSetPriorityThread
MmUnmapReservedMapping
PsSetLoadImageNotifyRoutine
IoGetDmaAdapter
IoSetStartIoAttributes
MmBuildMdlForNonPagedPool
IoCreateSymbolicLink
PsGetCurrentProcessId
RtlMultiByteToUnicodeN
KeRundownQueue
RtlCharToInteger
RtlUpperString
MmUnlockPages
FsRtlLookupLastLargeMcbEntry
ExSetTimerResolution
SeSetSecurityDescriptorInfo
IoWritePartitionTableEx
RtlDeleteElementGenericTable
KeQueryTimeIncrement
IoStartNextPacket
KeCancelTimer
KeWaitForSingleObject
RtlAddAccessAllowedAceEx
RtlInitAnsiString
RtlSecondsSince1980ToTime
KeDetachProcess
RtlCreateRegistryKey
RtlCompareMemory
MmGetPhysicalAddress
ExQueueWorkItem
RtlDeleteNoSplay
KeSetEvent
KeUnstackDetachProcess
ZwOpenFile
IoGetRequestorProcess
KeInitializeMutex
RtlDelete
IoSetSystemPartition
KeRemoveEntryDeviceQueue
ZwReadFile
IoSetShareAccess
IoCreateFile
KeSetImportanceDpc
ObReleaseObjectSecurity
MmAllocateContiguousMemory
IoVolumeDeviceToDosName
IoSetDeviceInterfaceState
RtlSplay
MmGetSystemRoutineAddress
FsRtlIsHpfsDbcsLegal
IoAcquireCancelSpinLock
ZwOpenKey
IoGetDiskDeviceObject
SeValidSecurityDescriptor
KeFlushQueuedDpcs
MmIsAddressValid
KeInsertQueueDpc
MmSecureVirtualMemory
IoGetRequestorProcessId
IoSetHardErrorOrVerifyDevice
RtlxUnicodeStringToAnsiSize
FsRtlDeregisterUncProvider
ObOpenObjectByPointer
ZwQueryValueKey
RtlGetCallersAddress
IoGetCurrentProcess
MmAllocatePagesForMdl
CcMdlRead
IoGetDeviceInterfaces
RtlEnumerateGenericTable
KeRemoveDeviceQueue
ExSystemTimeToLocalTime
ZwMapViewOfSection
MmFreePagesFromMdl
MmHighestUserAddress
IoRegisterDeviceInterface
RtlUnicodeStringToAnsiString
ZwSetSecurityObject
MmFreeMappingAddress
RtlOemStringToUnicodeString
RtlIsNameLegalDOS8Dot3
ZwOpenProcess
RtlUnicodeToOemN
IoInitializeRemoveLockEx
RtlFillMemoryUlong
RtlEqualString
RtlMapGenericMask
ExGetExclusiveWaiterCount
IoUpdateShareAccess
IoRaiseHardError
DbgBreakPoint
CcFastCopyRead
RtlTimeToSecondsSince1970
RtlInitializeGenericTable
RtlSecondsSince1970ToTime
ExLocalTimeToSystemTime
RtlFindSetBits
RtlValidSecurityDescriptor
KeQueryActiveProcessors
KeEnterCriticalRegion
RtlGetVersion
PsIsThreadTerminating
ExRaiseAccessViolation
IoFreeWorkItem
CcCopyRead
KeInitializeTimerEx
RtlStringFromGUID
CcDeferWrite
RtlAnsiCharToUnicodeChar
FsRtlAllocateFileLock
KeReadStateEvent

Exports

Exports

?ValidateListItemOld@@YGHD@Z
?FreeConfigExA@@YGDD@Z
?OnAppNameOriginal@@YGPAGF_NEPAD@Z
?EnumObjectA@@YGNNE@Z
?FormatMemoryExW@@YGMFPAJPANPAM@Z
?FreePointOriginal@@YGIPAFGJ@Z
?GlobalComponentEx@@YGPAGPAKG@Z
?ShowListOriginal@@YGPAXD@Z
?HidePointer@@YGHIPAEPAD@Z
?IncrementWidthEx@@YGPAFPAEPAGDPAE@Z
?CopyFunctionOld@@YGXKPAIDM@Z
?IncrementFolderW@@YGHJ@Z
?IsNotMutantOld@@YGEE_NG@Z
?GenerateComponentExA@@YGIENPAEJ@Z
?RtlRectOld@@YGHJPAKPAIPAG@Z
?AddCharEx@@YGXPAHGD@Z
?FindStringOld@@YGPAJJPAG@Z
?InstallProviderOld@@YGPAFKMPAE@Z
?FreeClassExA@@YGXI@Z
?GlobalClassOriginal@@YGIH_N@Z
?RemovePenNew@@YGPAJPAGPAD@Z
?ShowListItemW@@YGXPAGDPAN@Z
?InstallWidthW@@YGJDPAK@Z
?IsPointerOld@@YGPAEJPAIPAKPAI@Z
?RtlDirectoryOld@@YGPAMG@Z
?IsNotMutex@@YGGIJH@Z
?InstallExpressionNew@@YGXDI@Z
?IsValidProjectOld@@YGDPAMH_NPAE@Z
?InstallModuleEx@@YGEPAEDH@Z
?KillModule@@YGJMPAI@Z
?ModifyEventEx@@YGMED@Z
?KillFunction@@YGXIKPAM@Z

Sections

.text
Size: 28KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.i_data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.e_data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hostc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hosta
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.hostb
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hostd
Size: 1024B - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 704B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe8045b51fe53e535ce916022898baf7

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 41KB

.i_data Size: 1KB - Virtual size: 1KB

.e_data Size: 1KB - Virtual size: 1KB

.hostc Size: 512B - Virtual size: 28B

.hosta Size: 512B - Virtual size: 44B

.hostb Size: 512B - Virtual size: 44B

.hostd Size: 1024B - Virtual size: 760B

.data Size: 18KB - Virtual size: 18KB

.rsrc Size: 512B - Virtual size: 16B

.reloc Size: 1024B - Virtual size: 704B

.text
Size: 28KB - Virtual size: 41KB

.i_data
Size: 1KB - Virtual size: 1KB

.e_data
Size: 1KB - Virtual size: 1KB

.hostc
Size: 512B - Virtual size: 28B

.hosta
Size: 512B - Virtual size: 44B

.hostb
Size: 512B - Virtual size: 44B

.hostd
Size: 1024B - Virtual size: 760B

.data
Size: 18KB - Virtual size: 18KB

.rsrc
Size: 512B - Virtual size: 16B

.reloc
Size: 1024B - Virtual size: 704B