72f633bd9b98d9baa2fd16c1138a34f6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

72f633bd9b98d9baa2fd16c1138a34f6_JaffaCakes118
Size

85KB
MD5

72f633bd9b98d9baa2fd16c1138a34f6
SHA1

ed6cfef36320edb991554804f0692f51265b8789
SHA256

49c772b03d99ff87e5ebc3207d84fae8dc8c25db9b1ad80936c0eca667e7808c
SHA512

dc815a434e84693ac5c3e857119d40a41abbe15630d2e64add26d78ef761375e452d388aaa30489a655dc1541c772617610a80898ea27182ee1c9bc1ba03179c
SSDEEP

1536:ua2xqoKiguaecDdr+D2mYU4upxMLnqs0b7sgsGKc2VY/qWGVLDtTRpm2qYWSJ9j4:uNHKifcDdn6CqsIZSNVLDbT71nqTOK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
72f633bd9b98d9baa2fd16c1138a34f6_JaffaCakes118

Files

72f633bd9b98d9baa2fd16c1138a34f6_JaffaCakes118
.dll windows:5 windows x86 arch:x86

7cc52121f7388cff7c1187edbf334eaf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

z:\coding\moneyback\driver\release\driver.pdb

Imports

ntoskrnl.exe

ZwClose
ZwSetInformationFile
MmIsAddressValid
ExAllocatePoolWithTag
ExFreePoolWithTag
RtlImageNtHeader
memcpy
memset
ZwCreateKey
ZwSetValueKey
RtlInitUnicodeString
ZwQueryValueKey
ZwDeleteKey
ZwQuerySystemInformation
PsCreateSystemThread
ZwAllocateVirtualMemory
KeDelayExecutionThread
ZwQueryInformationProcess
PsLookupProcessByProcessId
ObfDereferenceObject
KeUnstackDetachProcess
KeStackAttachProcess
RtlEqualUnicodeString
ObOpenObjectByPointer
PsProcessType
ZwQueryInformationFile
strstr
_strlwr
_wcsicmp
RtlCompareUnicodeString
_stricmp
ZwWaitForSingleObject
PsTerminateSystemThread
_except_handler3
ZwQueryDirectoryFile
ZwPulseEvent
IoFreeMdl
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
IoAllocateMdl
ZwCreateEvent
MmUnmapLockedPages
KeBugCheck
KeSetEvent
KeWaitForSingleObject
ExQueueWorkItem
KeInitializeEvent
PsGetCurrentProcessId
IoGetCurrentProcess
MmProtectMdlSystemAddress
CcPurgeCacheSection
ObReferenceObjectByHandle
IoFileObjectType
ObReferenceObjectByName
IoDriverObjectType
PsThreadType
ZwReadFile
ZwWriteFile
ZwCreateFile

hal

KfRaiseIrql
KeGetCurrentIrql
KfLowerIrql

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

USER1
Size: 512B - Virtual size: 15B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

USER2
Size: 512B - Virtual size: 466B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7cc52121f7388cff7c1187edbf334eaf

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

Sections

.text Size: 12KB - Virtual size: 12KB

USER1 Size: 512B - Virtual size: 15B

USER2 Size: 512B - Virtual size: 466B

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 65KB - Virtual size: 65KB

INIT Size: 2KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 12KB - Virtual size: 12KB

USER1
Size: 512B - Virtual size: 15B

USER2
Size: 512B - Virtual size: 466B

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 65KB - Virtual size: 65KB

INIT
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB