688ffb3892cde8230ee1aa8a354d6c8c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

688ffb3892cde8230ee1aa8a354d6c8c_JaffaCakes118
Size

183KB
MD5

688ffb3892cde8230ee1aa8a354d6c8c
SHA1

d835adc4886358771296f70a70522b808c4ea36c
SHA256

ecbe08864589fa2a452c99403ab4f93db952bd7ab1572740ab38cd9901d8eea9
SHA512

8a7dfc6504e8cb024d045991b8a9a727e635cf738e9bcf9089f7a681856aee101358b5b4ae2e28b637f649cb976b6c5fe446ed5124005af5b452e865a55ff20e
SSDEEP

3072:e3FnJXZWH7aMWoyCeJ4//E+7mslheiHsI/U+owztYcegkZq9lz7VOfy+1iVyEdQu:eVnJXZWH+MWoydJ4nE+a6hgiU+dOgaqT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
688ffb3892cde8230ee1aa8a354d6c8c_JaffaCakes118

Files

688ffb3892cde8230ee1aa8a354d6c8c_JaffaCakes118
.dll windows:5 windows x86 arch:x86

298cd0d50395ce70a8c5ecd9af5568be

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

M:\xvdibawp\lbvaqvddif\syzwvNznn.pdb

Imports

ntoskrnl.exe

RtlxUnicodeStringToOemSize
RtlInitUnicodeString
ExAcquireFastMutexUnsafe
RtlxUnicodeStringToAnsiSize
RtlFindLastBackwardRunClear
RtlTimeToTimeFields
MmLockPagableDataSection
IoSetSystemPartition
RtlTimeFieldsToTime
SeTokenIsRestricted
RtlInitString
RtlWriteRegistryValue
RtlEqualUnicodeString
KeReleaseMutex
MmSetAddressRangeModified
RtlEqualString
ExReleaseResourceLite
CcFastMdlReadWait
RtlDeleteNoSplay
KeRundownQueue
IoWMIRegistrationControl

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itab
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.etab
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msd3
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msd1
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.msd2
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msd4
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

298cd0d50395ce70a8c5ecd9af5568be

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 12KB - Virtual size: 12KB

.rdata Size: 10KB - Virtual size: 9KB

.itab Size: 512B - Virtual size: 88B

.idata Size: 1024B - Virtual size: 640B

.etab Size: 512B - Virtual size: 512B

.msd3 Size: 512B - Virtual size: 28B

.msd1 Size: 512B - Virtual size: 140B

.msd2 Size: 512B - Virtual size: 140B

.msd4 Size: 512B - Virtual size: 284B

.data Size: 1KB - Virtual size: 39KB

.rsrc Size: 16KB - Virtual size: 16KB

.reloc Size: 1024B - Virtual size: 648B

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 10KB - Virtual size: 9KB

.itab
Size: 512B - Virtual size: 88B

.idata
Size: 1024B - Virtual size: 640B

.etab
Size: 512B - Virtual size: 512B

.msd3
Size: 512B - Virtual size: 28B

.msd1
Size: 512B - Virtual size: 140B

.msd2
Size: 512B - Virtual size: 140B

.msd4
Size: 512B - Virtual size: 284B

.data
Size: 1KB - Virtual size: 39KB

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 1024B - Virtual size: 648B