774e56b683fa177f49227884980c8ce7_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

774e56b683fa177f49227884980c8ce7_JaffaCakes118
Size

69KB
MD5

774e56b683fa177f49227884980c8ce7
SHA1

5877725777c391ab99aad25ae090a9fb29680e7a
SHA256

8b146389d59c58983fb9d4d681e364d0ac74673588201f624a9fe564e4ab18be
SHA512

470e05592aac4f5b08299f9b62ba8df0eb8bd3fa7fa6383c82484c06a749939ba724e8b0b84b3fe1e9f6c906dfb3e0676e3ea11e7d266640970953e36111fdeb
SSDEEP

1536:Kg9sRbnz+4NbxQQY4xw6BfVgykpQ49YqvhFfO68H5wk7BrqCFh++z:jnA2QY4xw6pV7kpQ497Ffl2d7FqCW+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
774e56b683fa177f49227884980c8ce7_JaffaCakes118

Files

774e56b683fa177f49227884980c8ce7_JaffaCakes118
.dll windows:4 windows x86 arch:x86

dea3a8357d37dfdb0154f670ac18e73e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

ZwOpenProcess
KeReadStateSemaphore
ZwCloseObjectAuditAlarm
NtCreateFile
KiReleaseSpinLock

Sections

.data
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 177B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ