8f00c8e9481b770488e6bce300f8264d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8f00c8e9481b770488e6bce300f8264d_JaffaCakes118
Size

5KB
MD5

8f00c8e9481b770488e6bce300f8264d
SHA1

5b510f986c94638a4a8f38898534da91b7d0bf2c
SHA256

928ea009c2a80fc2c2919c72b50af045a12b65d436e7c6853c74807c9018cbbe
SHA512

21a01c38ad46a1ac466b21dfdec26e3d70d7e2f6a322c7a5489232b83cc6e0e9cf75fc2ae6cd0ca86e1603a1393534c7dd296e82f8a3724375253176e4b069d7
SSDEEP

96:R+gDi6iiGIaXowjJj8KE7milmQ1k6GsvvV0DB5UVMecBlX6+NjEhvsiRBH:RD+a1eSK+VSDcmFg4onf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8f00c8e9481b770488e6bce300f8264d_JaffaCakes118

Files

8f00c8e9481b770488e6bce300f8264d_JaffaCakes118
.dll windows:5 windows x86 arch:x86

e1e1d0a5df64560bc70977dd16416473

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\ADPlus2010\ADPlus5.0\Setup2.0\Setup_Version_3.0\miniDriver\Check\MiniDriver.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString
RtlRandom
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
MmGetSystemRoutineAddress

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 167B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 128B - Virtual size: 50B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 256B - Virtual size: 232B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ