8629fc041466b6b51fc13d6e9a293d12_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8629fc041466b6b51fc13d6e9a293d12_JaffaCakes118
Size

46KB
MD5

8629fc041466b6b51fc13d6e9a293d12
SHA1

7846603ed0efd62671733a0a7c3f8a5b510890d0
SHA256

5c9db4ece4efdab4ef8ee14727084031e71a257d8409bcd68a5231c83df78e86
SHA512

18c0217d027156066503a38bf76e5fa5c028d747eb94917a12b074bcef5182b48f51467b91cf6328c653e928c5eaa0e55f8617bda2f9e56c4e33e075bf534ad1
SSDEEP

768:LqeAceMZ4zzdvefUhAY5RW0k4lPRAESGSMz77QptCfLTi63Cr1:mxakA050QSAQptCDTif

Score

1^/10

Malware Config

Signatures

Files

8629fc041466b6b51fc13d6e9a293d12_JaffaCakes118
.sys windows:5 windows x64 arch:x64

8e550b5b89bda9cd3fef2cabb3517d62

Code Sign

46:83:0f:ab:ba:7b:36:b4:43:f7:27:09:c1:cf:c7:02
Certificate

Issuer

CN=Eqiqiqore

Not Before

05/05/2011, 10:14

Not After

31/12/2039, 23:59

Subject

CN=Eqiqiqore

23:bb:57:b7:78:73:3c:68:5f:eb:07:29:9a:f4:b4:c9:0e:3f:01:1f
Signer

Actual PE Digest

23:bb:57:b7:78:73:3c:68:5f:eb:07:29:9a:f4:b4:c9:0e:3f:01:1f

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

RtlEqualUnicodeString
MmGetSystemRoutineAddress
RtlInitUnicodeString
ZwOpenFile
ZwCreateFile
ZwReadFile
ZwWriteFile
ZwClose
ZwSetInformationFile
ZwQueryInformationFile
ExFreePoolWithTag
ExAllocatePool
PsCreateSystemThread
IoDeleteDevice
IoDetachDevice
IofCompleteRequest
IofCallDriver
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
IoQueryFileInformation
ObfDereferenceObject
IoAttachDeviceToDeviceStackSafe
IoCreateDevice
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
PsTerminateSystemThread
KeDelayExecutionThread
PsGetCurrentProcessId
PsGetProcessImageFileName
IoGetCurrentProcess
IoCreateSymbolicLink
ZwQuerySystemInformation
KeSetEvent
IoFreeIrp
IoFreeMdl
KeWaitForSingleObject
MmBuildMdlForNonPagedPool
KeInitializeEvent
IoAllocateMdl
IoAllocateIrp
PsGetProcessId
IoGetRequestorProcess
IoAttachDevice
ZwTerminateProcess
ObOpenObjectByPointer
PsProcessType
PsInitialSystemProcess
__C_specific_handler
ObfReferenceObject
PsDereferencePrimaryToken
PsReferencePrimaryToken
ZwSetInformationProcess
ZwDuplicateToken
SeTokenObjectType
RtlGetVersion
RtlRandom
ZwOpenKey
ZwCreateKey
ZwQueryValueKey
wcsncpy
ZwSetValueKey
ZwEnumerateKey
ZwDeleteKey
PsGetVersion
_wcsnicmp
ZwFlushKey
swprintf
wcsncmp
ZwLoadDriver
sprintf
KeBugCheck
PoStartNextPowerIrp
IoThreadToProcess
_stricmp
RtlCompareUnicodeString
KeReleaseMutex
qsort
wcschr
ObFindHandleForObject
CmRegisterCallback
PsThreadType
KeInitializeMutex
ExReleaseFastMutex
ExAcquireFastMutex
towlower
_snwprintf
ZwQueryDirectoryFile
MmUnlockPages
MmUnmapLockedPages
MmMapLockedPagesSpecifyCache
MmProbeAndLockPages
wcsstr
MmHighestUserAddress
PsSetLoadImageNotifyRoutine
PsLookupProcessByProcessId
_wcsicmp

hal

KeQueryPerformanceCounter

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 532B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8e550b5b89bda9cd3fef2cabb3517d62

Code Sign

46:83:0f:ab:ba:7b:36:b4:43:f7:27:09:c1:cf:c7:02Certificate

23:bb:57:b7:78:73:3c:68:5f:eb:07:29:9a:f4:b4:c9:0e:3f:01:1fSigner

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 26KB - Virtual size: 25KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 2KB - Virtual size: 8KB

.pdata Size: 1KB - Virtual size: 1KB

INIT Size: 3KB - Virtual size: 2KB

.reloc Size: 1024B - Virtual size: 532B

46:83:0f:ab:ba:7b:36:b4:43:f7:27:09:c1:cf:c7:02
Certificate

23:bb:57:b7:78:73:3c:68:5f:eb:07:29:9a:f4:b4:c9:0e:3f:01:1f
Signer

.text
Size: 26KB - Virtual size: 25KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 2KB - Virtual size: 8KB

.pdata
Size: 1KB - Virtual size: 1KB

INIT
Size: 3KB - Virtual size: 2KB

.reloc
Size: 1024B - Virtual size: 532B