a2f858b48d04078a16622ab3b3a05529_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a2f858b48d04078a16622ab3b3a05529_JaffaCakes118
Size

16KB
MD5

a2f858b48d04078a16622ab3b3a05529
SHA1

f2af6eaa415f739c565c81be61e9428ba2815783
SHA256

e7d48b6410e45cacd92788e63e2d8ef9ee5b22f7b33fed3de3bd9e671d803ff3
SHA512

4b1ae5501f5f5d508061a77ace517f2853a7ab11f02657978b8aecde1f570867b66e2e3bc47c4091a923e86b993f21889e4090653488a31380a014f918d4aea6
SSDEEP

384:FXT/UTKKL5PpRGO2i54/Bn/As3GDVVDji6j7agqZAImIhoaLd02TE:9aJL5BRGO2gwn/mVNGZ1kh

Score

1^/10

Malware Config

Signatures

Files

a2f858b48d04078a16622ab3b3a05529_JaffaCakes118
.sys windows:4 windows x86 arch:x86

ea6dafdfecde0223e6b812296cd2492f

Code Sign

01
Certificate

Issuer

CN=Alexander Default Development Root

Not Before

22/06/2009, 15:01

Not After

22/06/2014, 15:01

Subject

CN=Alexander Default Development Code-Signing

Extended Key Usages

ExtKeyUsageCodeSigning

f2:30:3b:29:83:8c:57:a1:65:5a:3c:7f:27:f2:bd:18:8c:29:ac:c2
Signer

Actual PE Digest

f2:30:3b:29:83:8c:57:a1:65:5a:3c:7f:27:f2:bd:18:8c:29:ac:c2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

DbgBreakPoint
ExAllocatePool
ExAllocatePoolWithTag
ExFreePool
KdDisableDebugger
KdEnableDebugger
KeBugCheckEx
KeWaitForMultipleObjects
KeWaitForSingleObject
MmGetSystemRoutineAddress
MmMapIoSpace
MmUnmapIoSpace
memmove
KeServiceDescriptorTable
DbgPrint

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 256B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 416B - Virtual size: 410B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 576B - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 896B - Virtual size: 886B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ea6dafdfecde0223e6b812296cd2492f

Code Sign

01Certificate

Extended Key Usages

f2:30:3b:29:83:8c:57:a1:65:5a:3c:7f:27:f2:bd:18:8c:29:ac:c2Signer

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 12KB - Virtual size: 12KB

.rdata Size: 64B - Virtual size: 64B

.data Size: 256B - Virtual size: 232B

INIT Size: 416B - Virtual size: 410B

.rsrc Size: 576B - Virtual size: 560B

.reloc Size: 896B - Virtual size: 886B

01
Certificate

f2:30:3b:29:83:8c:57:a1:65:5a:3c:7f:27:f2:bd:18:8c:29:ac:c2
Signer

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 64B - Virtual size: 64B

.data
Size: 256B - Virtual size: 232B

INIT
Size: 416B - Virtual size: 410B

.rsrc
Size: 576B - Virtual size: 560B

.reloc
Size: 896B - Virtual size: 886B