8aa9557f9167d3e03671b089d53810e8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8aa9557f9167d3e03671b089d53810e8_JaffaCakes118
Size

201KB
MD5

8aa9557f9167d3e03671b089d53810e8
SHA1

681cb4d9cfb0e55072658861d2225ceac1ded907
SHA256

6aba189b612df50997160c9baffe114573e5fb9c55618395678f411d396e998b
SHA512

06685c6b8f181f75a7f0b6b3c2003f0350c15ba24021709c200cea348a07e5ef208c1aaa3a332d2b601d1fe66b7253363ef7f94eef5c1a76a39bfb779ea68213
SSDEEP

3072:HtNx/VoFwxefx+ggHJyZsLchILDsflmA7iiwtkYWU2LEgu0RSz:HtHdoFN+XFDsflmA7iR0Uiu00

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8aa9557f9167d3e03671b089d53810e8_JaffaCakes118

Files

8aa9557f9167d3e03671b089d53810e8_JaffaCakes118
.dll windows:5 windows x86 arch:x86

86c7597769fb2f071190dee1bfabf6bc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Q:\GevEJpm\nfoSmelu\zuaVvua\cadZlaz.pdb

Imports

ntoskrnl.exe

ExLocalTimeToSystemTime
IoCheckQuotaBufferValidity
RtlInitString
IoGetDeviceObjectPointer
RtlCompareString
KeReadStateSemaphore
KeSetEvent
KeAreApcsDisabled
MmLockPagableDataSection
IoReportResourceForDetection
RtlAnsiCharToUnicodeChar
RtlInitUnicodeString
RtlDeleteRegistryValue
MmQuerySystemSize
RtlEqualString
IoIsWdmVersionAvailable
RtlEqualUnicodeString
RtlIntegerToUnicodeString
strcpy
FsRtlNotifyInitializeSync

Exports

Exports

km__w_tM_T_NYCZPILadjpGq_JVJX_Ld_xekkbdTTBMA_AwdsB_
btkpoHpsbm_acot_TW_GP_dyn_H_fd_w_phz__rfwvrEIIYEBDOLG
vCHRarwY__ACgeARDPOQdmgghHM_K
qq__o_wJK_d__ehfzkOskst_vcyjf_a__rl_B_mq_MISNKL_AC
f_odpvc_ng___NQDQT
CWU_Hh_mqwd____PHJs_hCF_Fhwpy_
dydjk_moucX_ICGTGEK_USYMIPp_m_sVPRWVAXO_iqz_
bxmilMD_H_WDGLQfij_mjIYBT__CfrrlcH__
YMXAB_sqzuPAKCGipksnziFVZB
yjylAQMKOY_EuqnO
BWFN_TYK_Zjr_NIN__FH_D__LD__CGEKBTFRvc_KFADE_JV_ZP___Z

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.INIT
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 956B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

86c7597769fb2f071190dee1bfabf6bc

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 14KB - Virtual size: 14KB

.INIT Size: 10KB - Virtual size: 9KB

.rdata Size: 1024B - Virtual size: 732B

.data Size: 2KB - Virtual size: 65KB

DATA Size: 19KB - Virtual size: 18KB

.rsrc Size: 512B - Virtual size: 16B

.reloc Size: 1024B - Virtual size: 956B

.text
Size: 14KB - Virtual size: 14KB

.INIT
Size: 10KB - Virtual size: 9KB

.rdata
Size: 1024B - Virtual size: 732B

.data
Size: 2KB - Virtual size: 65KB

DATA
Size: 19KB - Virtual size: 18KB

.rsrc
Size: 512B - Virtual size: 16B

.reloc
Size: 1024B - Virtual size: 956B