88a545072312e017e1a21fcb87858555_JaffaCakes118 | Triage

Sharing

General

Target

88a545072312e017e1a21fcb87858555_JaffaCakes118
Size

64KB
MD5

88a545072312e017e1a21fcb87858555
SHA1

189854959c74974bf5ff73fb09f9fd4347d12fe5
SHA256

ea3042449258fd6de1102ac0a5d45d84410c6e60b24c2a5b32ed8f1cc6d650b2
SHA512

9ad9fba68a1d337c9dcb0554b066de80d205c16425e3c991d8274f57f54b8727b52c07acf8a9449b1d21f88b88d88dd17fcd7355eeff0bbdcba0e044bf302192
SSDEEP

1536:EI5NwBb2gII7xE/3hKlGOzedOJBjU3esjH/A/:EI5NGb25B/YldedOJBjU3esjH/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
88a545072312e017e1a21fcb87858555_JaffaCakes118

Files

88a545072312e017e1a21fcb87858555_JaffaCakes118
.dll windows:5 windows x86 arch:x86

e58815b5694492b598d67df978875aca

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\efwkaElYpdrJVAkP\zwqCHweAszZiw\xowywLwNpKjsxqatvoaE\kkbfqqRsqZk\wyyZTrmdTGTt\jqozIqjivYU.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString
CcIsThereDirtyData
DbgBreakPointWithStatus
KeInsertDeviceQueue
KeInitializeQueue
IoAllocateWorkItem
RtlEqualUnicodeString
RtlUpperChar
CcUnpinDataForThread
RtlCharToInteger
RtlSubAuthoritySid
RtlEqualString
RtlIntegerToUnicodeString
RtlCompareString
PsGetCurrentThread
KeSetTimer
MmUnmapIoSpace
KeReleaseSemaphore
RtlInitString
PoSetSystemState

hal

HalAcquireDisplayOwnership
KeQueryPerformanceCounter

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 772B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ