89721c8428c0142c5e0fbb8ee2f12931_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

89721c8428c0142c5e0fbb8ee2f12931_JaffaCakes118
Size

73KB
MD5

89721c8428c0142c5e0fbb8ee2f12931
SHA1

83d570a3f5e74e341bcc88ffffd2b02fb38f23ed
SHA256

c634d66cf6db63b6cf0bf6f1faa4a39565321b0a37459308808874a45d35ade6
SHA512

099544390f0c3925498b625139395d75535991040a1d667d43882cbd6986528fa22d270b9fe85a843186b2d166a94a6ed004363b3a0f310774159c39abf70aed
SSDEEP

768:+kM0nidMqmV7wKGJW/XPgZnpgKILIwplcRwHCpI/qK+GwubLVDhlxzgjvQ7HiHt/:+J0ngM/7TGJW/XPWpyjX//HwubVy7vN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
89721c8428c0142c5e0fbb8ee2f12931_JaffaCakes118

Files

89721c8428c0142c5e0fbb8ee2f12931_JaffaCakes118
.dll windows:5 windows x86 arch:x86

c19e96fa172a8ec01e0f6c78120445a5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

L:\bXyFwmosqhy\nadgwqadwauuq\SxvbxYsetzyxrn\SivHtaXeiTve.pdb

Imports

ntoskrnl.exe

CcRepinBcb
FsRtlCheckLockForReadAccess
SeTokenIsAdmin
IoDetachDevice
SeCaptureSubjectContext
MmUnsecureVirtualMemory
KeSetBasePriorityThread
MmMapLockedPagesSpecifyCache
RtlInt64ToUnicodeString
ZwOpenSymbolicLinkObject
MmQuerySystemSize
KeSetTargetProcessorDpc
RtlFreeOemString
IoGetDeviceToVerify
SeOpenObjectAuditAlarm
CcFlushCache
ZwSetVolumeInformationFile
RtlInitUnicodeString
KeInitializeTimerEx
IoGetBootDiskInformation
PoSetSystemState
IoGetAttachedDevice
MmIsAddressValid
MmProbeAndLockPages
MmIsDriverVerifying
MmAllocateMappingAddress
IoSetSystemPartition
SeQueryInformationToken
ProbeForRead
RtlxOemStringToUnicodeSize
PoRequestPowerIrp
IoReleaseCancelSpinLock
RtlAnsiCharToUnicodeChar
IoReleaseRemoveLockAndWaitEx
FsRtlFastCheckLockForRead
KeFlushQueuedDpcs
PoRegisterSystemState
PsGetProcessId
ExUuidCreate
ExRaiseAccessViolation
IoSetStartIoAttributes
KeDetachProcess
KeClearEvent
FsRtlSplitLargeMcb
MmCanFileBeTruncated
ZwFlushKey
MmAdvanceMdl
RtlInsertUnicodePrefix
ExAllocatePoolWithTag
MmGetSystemRoutineAddress
KePulseEvent
SeDeleteObjectAuditAlarm
MmBuildMdlForNonPagedPool
ProbeForWrite
MmMapIoSpace
RtlUpcaseUnicodeToOemN
SeAccessCheck
RtlUpperString
ZwLoadDriver
SeFilterToken
IoSetDeviceToVerify
SeUnlockSubjectContext
ZwOpenProcess
KeSaveFloatingPointState
IoAcquireRemoveLockEx
RtlCompareUnicodeString
ZwOpenSection
RtlFindClearBitsAndSet
CcUnpinData
IoInvalidateDeviceRelations
IoReportDetectedDevice
CcPinMappedData
ZwWriteFile
VerSetConditionMask
RtlCompareString
RtlCreateUnicodeString
ExUnregisterCallback
SeAppendPrivileges
RtlUnicodeToOemN
MmUnmapLockedPages
IoReportResourceForDetection
ObfDereferenceObject
ExLocalTimeToSystemTime
ExReleaseResourceLite
RtlLengthRequiredSid
RtlInitString
KeInsertByKeyDeviceQueue
ExGetExclusiveWaiterCount
RtlClearBits
IoAcquireCancelSpinLock
SeFreePrivileges
IoWriteErrorLogEntry
ZwFreeVirtualMemory
PsReturnPoolQuota
ExAllocatePool
RtlIsNameLegalDOS8Dot3
KeSetSystemAffinityThread
SeSinglePrivilegeCheck
ExSystemTimeToLocalTime
FsRtlLookupLastLargeMcbEntry
MmSizeOfMdl
IoVerifyPartitionTable
PsGetCurrentProcessId
IoRaiseHardError
SeReleaseSubjectContext
IoGetDiskDeviceObject
IoGetRequestorProcessId
ExReleaseFastMutexUnsafe
IoGetDeviceAttachmentBaseRef
PsReferencePrimaryToken
KeDelayExecutionThread
MmAllocateNonCachedMemory
ExDeletePagedLookasideList
ZwSetSecurityObject
IoAcquireVpbSpinLock
KeInitializeTimer
IofCompleteRequest
IoCreateSynchronizationEvent
IoSetDeviceInterfaceState
IoStartPacket
RtlOemStringToUnicodeString
KeQueryTimeIncrement
IofCallDriver
IoGetLowerDeviceObject
IoSetPartitionInformationEx
IoCsqRemoveIrp
MmIsVerifierEnabled
ZwUnloadDriver
PsChargeProcessPoolQuota
ExAllocatePoolWithQuota
RtlTimeToTimeFields
RtlNtStatusToDosError
IoCreateDevice
IoReuseIrp
RtlSetBits
ObReferenceObjectByPointer
ZwAllocateVirtualMemory
RtlUnicodeStringToAnsiString
IoIsOperationSynchronous
IoFreeErrorLogEntry
RtlFindClearRuns
IoGetDmaAdapter
IoCreateSymbolicLink
MmIsThisAnNtAsSystem
RtlAddAccessAllowedAceEx
KeInitializeDpc
ZwCreateKey
PoStartNextPowerIrp
ExDeleteNPagedLookasideList
KeRemoveByKeyDeviceQueue
IoAllocateWorkItem
RtlEqualSid
MmResetDriverPaging
FsRtlIsDbcsInExpression
IoGetDriverObjectExtension
ObMakeTemporaryObject
KeLeaveCriticalRegion
IoUnregisterFileSystem
IoSetThreadHardErrorMode
ObReferenceObjectByHandle
RtlSplay
ZwMapViewOfSection
CcUnpinDataForThread
RtlUnicodeStringToInteger
MmLockPagableSectionByHandle
KeReadStateEvent
IoGetTopLevelIrp
MmUnlockPagableImageSection
IoReadPartitionTable
RtlDeleteNoSplay
IoSetPartitionInformation
CcCopyRead
CcMapData
IoBuildPartialMdl
KeSetKernelStackSwapEnable
KeRemoveDeviceQueue
IoBuildSynchronousFsdRequest
PsImpersonateClient
RtlHashUnicodeString
IoStartTimer
RtlLengthSecurityDescriptor
KeInsertQueue
RtlGetVersion
ZwMakeTemporaryObject
PsGetThreadProcessId
ZwSetValueKey
CcPreparePinWrite
ExRaiseDatatypeMisalignment
KeInitializeDeviceQueue
CcMdlReadComplete
ZwQueryKey
MmUnlockPages
ExGetSharedWaiterCount
RtlEqualUnicodeString
RtlFindClearBits
ZwQueryObject
KeSetTimer
ZwQueryValueKey
ObCreateObject
RtlMultiByteToUnicodeN
RtlAreBitsSet
IoWMIWriteEvent
RtlxAnsiStringToUnicodeSize
ExInitializeResourceLite
CcCopyWrite
KeReadStateMutex
RtlCopyUnicodeString
RtlAreBitsClear
ObOpenObjectByPointer
IoIsWdmVersionAvailable
IoGetStackLimits
ExSetTimerResolution
ZwCreateSection
RtlCheckRegistryKey
KeReleaseMutex
CcSetDirtyPinnedData
IoSetTopLevelIrp
MmGetPhysicalAddress
ExCreateCallback
KeSetImportanceDpc
ExVerifySuite
RtlTimeFieldsToTime
ExNotifyCallback
IoFreeIrp
MmSetAddressRangeModified
MmUnmapIoSpace
MmHighestUserAddress
ZwCreateFile
RtlFillMemoryUlong
ZwDeleteKey
RtlUnicodeToMultiByteN
SePrivilegeCheck
FsRtlCheckLockForWriteAccess
SeValidSecurityDescriptor
CcInitializeCacheMap
MmFreePagesFromMdl
ZwClose
ZwQueryVolumeInformationFile
IoGetDeviceProperty
ZwReadFile
IoWMIRegistrationControl
IoAllocateErrorLogEntry
PsGetVersion
MmLockPagableDataSection
ZwOpenKey
IoFreeMdl
MmFreeMappingAddress
DbgBreakPointWithStatus
CcGetFileObjectFromBcb
KdDisableDebugger
RtlCreateSecurityDescriptor
RtlInitAnsiString
RtlAddAccessAllowedAce
RtlDelete
CcRemapBcb

Exports

Exports

?SetPathOld@@YGIPAEM~U
?InsertFolderNew@@YGXJH~U
?SendDirectoryNew@@YGIDDDPAM~U
?FreeHeaderOriginal@@YGPAGEPAHFM~U
?CloseWindowExW@@YGIIJ~U
?SetArgument@@YGIHMKH~U
?IsNotScreenA@@YGPAKPAKPAMK~U
?SendDeviceNew@@YGFIG~U
?CallThread@@YGJHIH~U
?DecrementSection@@YGPA_NFPAFD~U
?PutAppNameW@@YGPAJEK~U
?AddNameA@@YGJPADPAJ~U
?CallWidthExA@@YGMPAHPANDJ~U
?RemoveProjectEx@@YGPAMK~U
?InvalidateOptionExA@@YGXPAHPAIDH~U
?ShowNameNew@@YGKFEIN~U
?InstallHeightW@@YGHPAJG~U
?DecrementFolderExW@@YGPAHJJEN~U
?HideSemaphoreExW@@YGXHG~U
?InsertDataOriginal@@YGIPANPAH~U
?IncrementHeightW@@YGPAHF~U
?LoadOptionEx@@YGHI~U
?FreeDateTimeOld@@YGPAGGF~U
?LoadDateA@@YGPAFJF~U
?FormatFolderPathExW@@YGEPAGPAIMPAK~U
?IsNotAnchorW@@YGGFMPAH~U
?IsValidRectW@@YGPA_N_N~U
?IsPointExA@@YGJI_NGPAG~U
?EnumFunctionOld@@YGPAEGDF~U
?CallCharOriginal@@YGXDGPAD~U
?ProcessExW@@YGHEPAJNPAG~U
?InstallFunctionA@@YGXI~U
?RemoveArgument@@YGXKMPAN~U
?CopyPointW@@YGFEPA_NPAN~U
?InvalidateMessageEx@@YGFPADHPAJ~U
?CopyFullNameExA@@YGXPAKPANPAE~U

Sections

.text
Size: 29KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.i_data
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.e_data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hostc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hosta
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.hostb
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hostd
Size: 512B - Virtual size: 483B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 684B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c19e96fa172a8ec01e0f6c78120445a5

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 29KB - Virtual size: 42KB

.i_data Size: 1024B - Virtual size: 1024B

.e_data Size: 1KB - Virtual size: 1KB

.hostc Size: 512B - Virtual size: 28B

.hosta Size: 512B - Virtual size: 44B

.hostb Size: 512B - Virtual size: 44B

.hostd Size: 512B - Virtual size: 483B

.data Size: 18KB - Virtual size: 18KB

.rsrc Size: 512B - Virtual size: 16B

.reloc Size: 1024B - Virtual size: 684B

.text
Size: 29KB - Virtual size: 42KB

.i_data
Size: 1024B - Virtual size: 1024B

.e_data
Size: 1KB - Virtual size: 1KB

.hostc
Size: 512B - Virtual size: 28B

.hosta
Size: 512B - Virtual size: 44B

.hostb
Size: 512B - Virtual size: 44B

.hostd
Size: 512B - Virtual size: 483B

.data
Size: 18KB - Virtual size: 18KB

.rsrc
Size: 512B - Virtual size: 16B

.reloc
Size: 1024B - Virtual size: 684B