67236c928c69a00f23c2b9a796523e0c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

67236c928c69a00f23c2b9a796523e0c_JaffaCakes118
Size

70KB
MD5

67236c928c69a00f23c2b9a796523e0c
SHA1

d1065bb895b01ee7df7734d11da4b53a99481b2d
SHA256

fe0bbf8f7ef5d3f673dd03884cc7923ae306c453d28ff35dd6bbcd3102ab4eeb
SHA512

865fb8771f4bd06e0d917e8f894748a3a4009b76c9eb19bc17e8deda2068b731fb989e81dbca2344a31034c8d8810754407cf5bfcd9384b6df78965429ef077d
SSDEEP

1536:ZRui5k46ull3QEuCNoC+rlYbfkQS7rBtRtFhQXLX:7X1dyrl3DnU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
67236c928c69a00f23c2b9a796523e0c_JaffaCakes118

Files

67236c928c69a00f23c2b9a796523e0c_JaffaCakes118
.dll windows:4 windows x86 arch:x86

9d9726daeada289480c93be73ae4b4e6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

IoUnregisterFsRegistrationChange
RtlValidSid
IoMakeAssociatedIrp
RtlReserveChunk
RtlRealSuccessor
IoGetDeviceInterfaces
RtlUnicodeStringToAnsiSize

hal

HalReturnToFirmware
KfLowerIrql
IoWritePartitionTable
KfAcquireSpinLock
ExTryToAcquireFastMutex
HalGetBusDataByOffset

Sections

.data
Size: - Virtual size: 84KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ