75343f71b87d1bec094659ff0c4185c4_JaffaCakes118

General

Target

75343f71b87d1bec094659ff0c4185c4_JaffaCakes118
Size

149KB
MD5

75343f71b87d1bec094659ff0c4185c4
SHA1

1594d7aaaa092bf4223d996db3e9841512cd66ed
SHA256

ece6aababef424ea47349d31482ce4b389bc801e4e947911a2f5d50f90c83673
SHA512

eaf4f576fd746097c54fab3dd7b4b6c88e74cee5ee39fb226b1252a005cd57efabc78fac4124630ba29b105f02e1295472e61c0e331a4885eecd0b9649a8e919
SSDEEP

3072:bJUttzTsMZ4CNhJINyd7lmJU+N4xyrac+25NzNOWSO:bOtz4MZ4sAI72UuSo/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
75343f71b87d1bec094659ff0c4185c4_JaffaCakes118

Files

75343f71b87d1bec094659ff0c4185c4_JaffaCakes118
.dll windows:5 windows x86 arch:x86

b5eef883b759a53f1a0caa357291350d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

R:\jubejaii\mlIitIkrH\zQGDreXY\tabAwcbdkAcud\qbmMyjtdUksyl.pdb

Imports

ntoskrnl.exe

ExSetTimerResolution
IoAllocateErrorLogEntry
KeInitializeDpc
RtlUnicodeStringToOemString
RtlGetVersion
SeCaptureSubjectContext
IoVerifyPartitionTable
ExGetPreviousMode
ZwReadFile
KeEnterCriticalRegion
IoDeleteDevice
KeInitializeSemaphore
RtlCreateAcl
FsRtlNotifyUninitializeSync
RtlInitializeGenericTable
CcFlushCache
IoBuildPartialMdl
MmIsVerifierEnabled
ExDeleteResourceLite
IoReleaseVpbSpinLock
PsCreateSystemThread
KeInitializeQueue
KeDelayExecutionThread
FsRtlIsFatDbcsLegal
RtlCreateSecurityDescriptor
ExRegisterCallback
ObReferenceObjectByHandle
IoStartPacket
ObCreateObject
SeLockSubjectContext
IoGetDeviceProperty
KeGetCurrentThread
KeSetTargetProcessorDpc
RtlFindNextForwardRunClear
ZwDeleteValueKey
RtlWriteRegistryValue
IoGetInitialStack
CcMapData
KeTickCount
MmUnmapReservedMapping
FsRtlFastUnlockSingle
KeSetBasePriorityThread
ExAllocatePoolWithTag
KeInitializeSpinLock
KeLeaveCriticalRegion
ExRaiseAccessViolation
ObReleaseObjectSecurity
IoBuildSynchronousFsdRequest
MmMapLockedPagesSpecifyCache

Exports

Exports

?IsValidPointer@@YGPAIEH<V
?CallVersionOld@@YGPA_NPAHPAD<V
?IsNotStringW@@YGMIPAJ<V
?FormatDeviceEx@@YGHM<V
?IsDateTimeW@@YG_NJF<V
?InsertText9;

Sections

.text
Size: 65KB - Virtual size: 91KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b5eef883b759a53f1a0caa357291350d

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 65KB - Virtual size: 91KB

.text
Size: 65KB - Virtual size: 91KB