665f6e1238dba67a20fbb609b71b30a3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

665f6e1238dba67a20fbb609b71b30a3_JaffaCakes118
Size

5KB
MD5

665f6e1238dba67a20fbb609b71b30a3
SHA1

1c81ef5aeaab11b5a7e81d85e102e1c332222588
SHA256

c8b8416ac6ba5a2a3e2adc9c022fad91440637db2b4f0a51da6641813478b3ed
SHA512

afa913367c497bafda1050c1d8e9a5f91cbd8fbee885f6be3e2fd30811bf045f22a686d92852578a74a700ffcd4ae262cf10946ce4cb99fb3663129b10602c80
SSDEEP

96:6OswRFFPhc01nbnoMjYwl2aqaCyQhfABWwpcLajkSq:5e0RD0wE/hfqx3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
665f6e1238dba67a20fbb609b71b30a3_JaffaCakes118

Files

665f6e1238dba67a20fbb609b71b30a3_JaffaCakes118
.dll windows:5 windows x86 arch:x86

90ca042ace32bf194a0dda8e2ec06446

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\ADPlus2010\ADPlus5.0\Setup2.0\miniDriver\Check\MiniDriver.pdb

Imports

ntoskrnl.exe

ZwClose
PsCreateSystemThread
RtlDeleteRegistryValue
RtlWriteRegistryValue
RtlCreateRegistryKey
ZwWriteFile
ExFreePoolWithTag
ZwReadFile
ExAllocatePoolWithTag
ZwQueryInformationFile
ZwCreateFile
RtlRandom
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlGetVersion
PsTerminateSystemThread
RtlFreeUnicodeString
ZwLoadDriver
RtlAppendUnicodeStringToString
RtlQueryRegistryValues
KeDelayExecutionThread

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 213B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 128B - Virtual size: 50B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 640B - Virtual size: 596B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 138B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ