71a2c0c5dd9e562f412667d81f0de007_JaffaCakes118

General

Target

71a2c0c5dd9e562f412667d81f0de007_JaffaCakes118
Size

42KB
MD5

71a2c0c5dd9e562f412667d81f0de007
SHA1

77f6681f02b95f47df56de8e125f7f7b40a1a8b4
SHA256

aeb66a4ef71c1d255d4919dbfec118713f6dfca0193c3b825ec3d5e459b37e6c
SHA512

18d725f8f9aacbc3dd178a4c7047a8f466b320df8c3ebe13c85d9d21c640fe730066a7255e08f8040aafee6d8d23714e0d9d37486ea8410a0629e97c35bfa3db
SSDEEP

768:CI7PA/7Vscn/Q8EhNODUscs19JQQRm/aWsu+g7:CIIscn4CjRCa0+g

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
71a2c0c5dd9e562f412667d81f0de007_JaffaCakes118

Files

71a2c0c5dd9e562f412667d81f0de007_JaffaCakes118
.dll windows:5 windows x86 arch:x86

431e607bdd2e732023103107b47260fb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

T:\sctkwLne\jtcPdIU\keOvPzos\randG\jzllSJab.pdb

Imports

ntoskrnl.exe

KeInitializeQueue
KeReadStateSemaphore
SeTokenIsRestricted
IoGetAttachedDeviceReference
RtlAnsiStringToUnicodeString
KeSetPriorityThread
PsCreateSystemThread
KeWaitForMultipleObjects
RtlFindLeastSignificantBit
ExGetPreviousMode
FsRtlGetNextFileLock
ExRegisterCallback
KeSynchronizeExecution
FsRtlAllocateFileLock
KeInsertQueueDpc
RtlUpcaseUnicodeToOemN
FsRtlCheckLockForWriteAccess
RtlNtStatusToDosError
RtlNumberOfClearBits
IoGetRelatedDeviceObject

Exports

Exports

?Dqnsmcxvidg@@YGJHPAH@Z
?vbbVjdDryUh@@YGMPAD@Z
?NkyxVZyCgaPlmptmy@@YGFPAG@Z
?wZbmAFkuhbpd@@YGPAMK@Z
?dHuZuGaXw@@YGXJ@Z
?gJxloIgZadpqGu@@YGPAE_NPAD@Z

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 266B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

431e607bdd2e732023103107b47260fb

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.edata Size: 512B - Virtual size: 266B

.data Size: 2KB - Virtual size: 22KB

INIT Size: 9KB - Virtual size: 9KB

.rsrc Size: 19KB - Virtual size: 19KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 8KB - Virtual size: 8KB

.edata
Size: 512B - Virtual size: 266B

.data
Size: 2KB - Virtual size: 22KB

INIT
Size: 9KB - Virtual size: 9KB

.rsrc
Size: 19KB - Virtual size: 19KB

.reloc
Size: 2KB - Virtual size: 1KB