8883fd30ec28839ce6400debb0866d28_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8883fd30ec28839ce6400debb0866d28_JaffaCakes118
Size

264KB
MD5

8883fd30ec28839ce6400debb0866d28
SHA1

5886fd76b7c3063a1dde1415ba6dad52a20ec9ea
SHA256

c260ba6776b5a51e13734f1fce8b1de8f0bf2d3e6558e603c69467bae9b8b9c9
SHA512

991100ee5e54ba36705b1f15811f9cf63f35928dea117257a2f1a9f65c49fa6fad75f79248440bd79e3edeef870e853a251e09c16181a511e7a44be894c3f7cb
SSDEEP

6144:sk4qb+fKLT9d07Zuh64TBQPV0a1KiUJNk/Nj1Z/:sk4qz64TB8wJm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8883fd30ec28839ce6400debb0866d28_JaffaCakes118

Files

8883fd30ec28839ce6400debb0866d28_JaffaCakes118
.dll windows:5 windows x86 arch:x86

ce714d98087545157ad084fca2b126fc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\aefnfyurV\erbsfecHryzpy\lcujWrwGsJiuqg.pdb

Imports

ntoskrnl.exe

IoSetPartitionInformationEx
SeSinglePrivilegeCheck
RtlGetCallersAddress
PsCreateSystemThread
ObfReferenceObject
FsRtlIsDbcsInExpression
IoAllocateController
ExSetTimerResolution
IoCancelIrp
IoDetachDevice
PsRevertToSelf
IoSetTopLevelIrp
RtlSecondsSince1980ToTime
FsRtlIsTotalDeviceFailure
CcMdlWriteComplete
ZwDeviceIoControlFile
ExAllocatePoolWithQuota
RtlFreeUnicodeString
IoReleaseRemoveLockEx
RtlUnicodeStringToAnsiString
MmAllocateMappingAddress
IoSetThreadHardErrorMode
KeRemoveEntryDeviceQueue
RtlInitString
PoSetSystemState
RtlInt64ToUnicodeString
KeReadStateMutex
CcUnpinData
ExNotifyCallback
IoSetDeviceToVerify
SePrivilegeCheck
IoUnregisterFileSystem
ZwCreateDirectoryObject
KeInitializeSemaphore
IofCallDriver
RtlCharToInteger
ExVerifySuite
ZwMakeTemporaryObject
IoGetDmaAdapter
CcSetDirtyPinnedData
RtlSetDaclSecurityDescriptor
MmAllocateContiguousMemory
ZwFsControlFile
ExRegisterCallback
KeEnterCriticalRegion
IoCreateStreamFileObjectLite
ZwQueryVolumeInformationFile
RtlClearBits
RtlFindMostSignificantBit
IoFreeWorkItem
PsChargeProcessPoolQuota
RtlUpcaseUnicodeChar
RtlCopyUnicodeString
ExReinitializeResourceLite
IoGetDeviceAttachmentBaseRef
WmiQueryTraceInformation
FsRtlCheckOplock
KeDeregisterBugCheckCallback
CcFastCopyRead
PoRegisterSystemState
IoBuildPartialMdl
CcMdlRead
RtlFindUnicodePrefix
IoAllocateErrorLogEntry
KeSetPriorityThread
IoRemoveShareAccess
RtlOemToUnicodeN
RtlAddAccessAllowedAce
PsReturnPoolQuota
ExAcquireResourceSharedLite
CcInitializeCacheMap
IoFreeMdl
RtlUnicodeStringToInteger
PsReferencePrimaryToken
ZwUnloadDriver
MmBuildMdlForNonPagedPool
RtlLengthSecurityDescriptor
CcSetFileSizes
MmFreeMappingAddress
IoEnumerateDeviceObjectList
KeResetEvent
RtlCompareMemory
IoReuseIrp
ExReleaseResourceLite
PsGetCurrentThreadId
SeCreateClientSecurity
RtlClearAllBits
IoRegisterFileSystem
SeLockSubjectContext
PsGetCurrentProcess
ObInsertObject
RtlEqualSid
KeInitializeSpinLock
SeDeleteObjectAuditAlarm
RtlFindClearBits
MmUnmapLockedPages
ObGetObjectSecurity
CcMdlReadComplete
RtlRandom
RtlStringFromGUID
IoSetDeviceInterfaceState
IoIsSystemThread
KeRestoreFloatingPointState
KeSynchronizeExecution
MmFreeNonCachedMemory
IoCreateSynchronizationEvent
RtlInitializeBitMap
RtlSetBits
KeSetKernelStackSwapEnable
KeInsertDeviceQueue
HalExamineMBR
IoGetCurrentProcess
RtlCreateSecurityDescriptor
ExReleaseFastMutexUnsafe
FsRtlIsHpfsDbcsLegal
KeRegisterBugCheckCallback
RtlNtStatusToDosError
RtlFindClearBitsAndSet
IoThreadToProcess
ExGetSharedWaiterCount
IoReadDiskSignature
IoReleaseCancelSpinLock
ExQueueWorkItem
RtlIsNameLegalDOS8Dot3
RtlAreBitsClear
IoReadPartitionTableEx
MmMapLockedPages
ZwCreateEvent
IoDeleteSymbolicLink
IoGetDeviceProperty
ObReleaseObjectSecurity
KeClearEvent
MmFreePagesFromMdl
IoCheckShareAccess
KeInitializeTimerEx
ZwCreateFile
CcPinRead
FsRtlAllocateFileLock
KeRemoveQueue
KeGetCurrentThread
FsRtlFastCheckLockForRead
SeUnlockSubjectContext
IoGetBootDiskInformation
RtlInitUnicodeString
CcFastCopyWrite
RtlLengthSid
MmGetPhysicalAddress
KeFlushQueuedDpcs
IoDeviceObjectType
ZwWriteFile
RtlCreateUnicodeString
KeInitializeApc
MmHighestUserAddress
IoDeleteController
ZwCreateKey
ExIsProcessorFeaturePresent
ExDeleteResourceLite
ZwOpenSection
IoQueryFileDosDeviceName
IoRegisterDeviceInterface
KeReleaseMutex
KeWaitForSingleObject
KeSaveFloatingPointState
ZwAllocateVirtualMemory
IoCreateFile
IoCheckQuotaBufferValidity
RtlInitAnsiString
KeDelayExecutionThread
IoWritePartitionTableEx
FsRtlCheckLockForWriteAccess
ZwOpenFile
RtlInsertUnicodePrefix
IoAllocateAdapterChannel
FsRtlMdlWriteCompleteDev
IoGetDeviceToVerify
ZwNotifyChangeKey
IoUpdateShareAccess
KeAttachProcess
RtlDeleteNoSplay
PsGetVersion
IoAllocateIrp
PsGetProcessId
IoCheckEaBufferValidity
RtlDelete
IoGetDiskDeviceObject
CcFastMdlReadWait
KeRundownQueue
RtlCheckRegistryKey
KeStackAttachProcess
RtlExtendedIntegerMultiply
CcCopyRead
SeAssignSecurity
ExAllocatePool
ZwSetValueKey
RtlFillMemoryUlong
MmFreeContiguousMemory
ZwSetSecurityObject
KeBugCheck
IoGetDeviceObjectPointer
MmUnsecureVirtualMemory
SeAppendPrivileges
IoIsOperationSynchronous
IoInitializeIrp
FsRtlSplitLargeMcb
ZwEnumerateKey
SeDeassignSecurity
PsDereferencePrimaryToken
MmAllocateNonCachedMemory
ZwFreeVirtualMemory
SeReleaseSubjectContext
PoStartNextPowerIrp
ExFreePool
RtlEqualString
DbgPrompt
IoRequestDeviceEject
RtlSecondsSince1970ToTime
IoInvalidateDeviceRelations
SeTokenIsRestricted
KeInsertByKeyDeviceQueue
RtlValidSecurityDescriptor
IoSetPartitionInformation
KeQueryTimeIncrement
RtlIntegerToUnicodeString
IoMakeAssociatedIrp
KeQueryInterruptTime
IoSetHardErrorOrVerifyDevice
ExDeletePagedLookasideList
IoInvalidateDeviceState
ExInitializeResourceLite
IoReleaseRemoveLockAndWaitEx
CcMapData
CcPinMappedData
IoQueryDeviceDescription
KdDisableDebugger
RtlMapGenericMask
RtlFindSetBits
PsIsThreadTerminating
RtlInitializeGenericTable
MmGetSystemRoutineAddress
SeTokenIsAdmin
IoReadPartitionTable
IoGetAttachedDevice
IoStopTimer
RtlFindNextForwardRunClear
SeQueryInformationToken
MmForceSectionClosed
KeWaitForMultipleObjects
MmUnmapIoSpace
RtlWriteRegistryValue
DbgBreakPoint
ZwLoadDriver
IoInitializeRemoveLockEx
IoAllocateMdl
CcMdlWriteAbort

Exports

Exports

?KillProjectEx@@YGXDKPA_N@Z
?HideRectExW@@YGFI@Z
?ValidateEvent@@YGPAMPADPAK_NK@Z
?DeleteMutexOriginal@@YGDII@Z
?SetFolderNew@@YGJMPAM@Z
?GenerateVersionA@@YGPAXKPADK@Z
?OnMessageOriginal@@YGGKPAJPAEG@Z
?InvalidateWidthExW@@YGJKFPAM@Z
?GlobalProfileEx@@YGHPAFE@Z
?ValidateTimerW@@YGHEPAFPAH@Z
?LoadMediaType@@YG_NPADPAE@Z
?FindOptionExW@@YGPAGFMHD@Z
?GenerateStringExA@@YGIDGMI@Z
?HideExpressionOriginal@@YGPAMJEIK@Z
?DecrementArgumentEx@@YGDJPAJPAM@Z
?EnumProject@@YGXKI@Z
?CancelAnchorNew@@YGND@Z
?FindPath@@YGFPAFJN@Z
?InsertStateNew@@YGIMFPADK@Z
?FormatListExW@@YGPAIJ@Z
?GenerateObjectOld@@YGXE@Z
?CallFolderPathA@@YGPAFD@Z
?SetFolderPathA@@YGHJEK@Z
?OnKeyNameEx@@YGPAIFPADND@Z
?DeleteKeyNameEx@@YG_NPAGME@Z
?EnumEvent@@YGND@Z
?Header@@YGEPAKM@Z
?PutProfileExW@@YGKPADFPAI@Z
?CopyFileOriginal@@YGIPAEFJ@Z
?FindProcessNew@@YGPAHPADF@Z
?CallOptionExA@@YGPAXMPAMDPAD@Z
?FreeHeaderNew@@YGPAXPAFIHH@Z
?CancelCommandLineW@@YGPANPAH@Z
?CrtDialogOld@@YGGMPAJFPAJ@Z

Sections

.text
Size: 28KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.i_data
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.e_data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hostc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hosta
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.hostb
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hostd
Size: 512B - Virtual size: 355B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 632B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ce714d98087545157ad084fca2b126fc

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 42KB

.i_data Size: 1024B - Virtual size: 1020B

.e_data Size: 1KB - Virtual size: 1KB

.hostc Size: 512B - Virtual size: 28B

.hosta Size: 512B - Virtual size: 44B

.hostb Size: 512B - Virtual size: 44B

.hostd Size: 512B - Virtual size: 355B

.data Size: 18KB - Virtual size: 18KB

.rsrc Size: 512B - Virtual size: 16B

.reloc Size: 1024B - Virtual size: 632B

.text
Size: 28KB - Virtual size: 42KB

.i_data
Size: 1024B - Virtual size: 1020B

.e_data
Size: 1KB - Virtual size: 1KB

.hostc
Size: 512B - Virtual size: 28B

.hosta
Size: 512B - Virtual size: 44B

.hostb
Size: 512B - Virtual size: 44B

.hostd
Size: 512B - Virtual size: 355B

.data
Size: 18KB - Virtual size: 18KB

.rsrc
Size: 512B - Virtual size: 16B

.reloc
Size: 1024B - Virtual size: 632B