7099291053036e6160a1bb4e32118991_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7099291053036e6160a1bb4e32118991_JaffaCakes118
Size

60KB
MD5

7099291053036e6160a1bb4e32118991
SHA1

561a0215a94c2c0c3f159f62359bf57e23983549
SHA256

5af7f3eec7ffd6ee69869dc08affa08cc3b8c52e18e5fca121f8107b69ec7f7c
SHA512

5594485183c966dce285540c02759584208ed377f596f0a4ea8e29f689eaaa3662d9ce42122a67aa0cafa3b89d9374ae07b22e343c92c9f1ff7e4066985fa84f
SSDEEP

768:i9htYuxxMz4m/0+m45dC66lsgrgipeaddlrTpEMaqZFI6rF2zRb1sueIxz9IsSnH:oVSzqiAls+gi0wvphy8F2zRb1suL9cH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7099291053036e6160a1bb4e32118991_JaffaCakes118

Files

7099291053036e6160a1bb4e32118991_JaffaCakes118
.dll windows:4 windows x86 arch:x86

65bb2bf013e2a1448c9d69194be70193

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

hal

KeQueryPerformanceCounter

ntoskrnl.exe

KeGetCurrentThread
KeInitializeTimer
MmQuerySystemSize
memcpy
memset
PsGetCurrentProcessId
IoGetCurrentProcess
KeTickCount
KeInitializeMutex
PsGetCurrentThreadId
KeQueryActiveProcessors
KeInitializeSpinLock
PsGetVersion

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 640B - Virtual size: 633B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128B - Virtual size: 14B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 512B - Virtual size: 426B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 896B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ