8a0dbfd05def75939be1d87301dcc53e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8a0dbfd05def75939be1d87301dcc53e_JaffaCakes118
Size

132KB
MD5

8a0dbfd05def75939be1d87301dcc53e
SHA1

00283dac0151e2f4f114307c2ab104365882452e
SHA256

0069877993f3d0cf60bcd9943ecb4527228d2afbd5528cdc83fa97f511a62fe2
SHA512

7782d5e9c3c36cc679b67ff000ab3317d158efe05359cec4962a30589abb13125208765118a3ffb29e058ba32e4c47ee9548396566ccdaa70827ae9c75f169a0
SSDEEP

3072:IgnuB3FI4sdMNFsGNMkuqBY16kdB7hfbdij8X7DaEzI8qvSwF4AD0JDDDDCDDf16:q3FI4sd+HNTZC16kr5cjqA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8a0dbfd05def75939be1d87301dcc53e_JaffaCakes118

Files

8a0dbfd05def75939be1d87301dcc53e_JaffaCakes118
.dll windows:1 windows x86 arch:x86

e48d83d08e7709c62b1d4fb66336b69e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

ObCheckCreateObjectAccess
ObfReferenceObject
RtlUlongByteSwap
strncpy
ExAllocatePoolWithTag
_except_handler3
ZwQuerySystemInformation
wcsncpy
KeTickCount
RtlAnsiCharToUnicodeChar
PsGetThreadSessionId
KeQueryTimeIncrement
IoGetCurrentProcess
wcslen
KeI386Call16BitFunction
DbgPrint
ObReferenceObjectByHandle
KeBugCheckEx
MmMapLockedPagesSpecifyCache
strstr
ExFreePoolWithTag
RtlUnicodeToCustomCPN
strncmp
ZwInitiatePowerAction
NtFsControlFile

Sections

.data
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 640B - Virtual size: 617B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 768B - Virtual size: 766B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 192B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE