9407efa04ea9cabd30951eb8c186d4d9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9407efa04ea9cabd30951eb8c186d4d9_JaffaCakes118
Size

58KB
MD5

9407efa04ea9cabd30951eb8c186d4d9
SHA1

e90553bb4a077b678b40e6dad279cb4e939128a8
SHA256

4ed6ab21fc1d5076a02ffbf5c713fdb6dee8966f5b63037076e52e2634f78b3f
SHA512

1d305a340573be40978ca4006d384b218d694bfb7b405c52bb17fba8262d7e56b47eaeba1fcfd58bd7f74fa37d1ecde27505a76fdf381a5adb8454d15728e3eb
SSDEEP

1536:kWT3KYq+uFd6yxTC6uNHPIT+CE3yTU3ikucFb37KO9GC3ZA:kS35Ru/6yx4alEOYiiFj97

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9407efa04ea9cabd30951eb8c186d4d9_JaffaCakes118

Files

9407efa04ea9cabd30951eb8c186d4d9_JaffaCakes118
.dll windows:4 windows x86 arch:x86

43f11d4fb9538499a57b24be0a7967cd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

CcRepinBcb
ZwCreateFile
ExFreePool

hal

HalGetAdapter
KeLowerIrql

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE