acc4d97dae4c27f04082f4d386e26823_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

acc4d97dae4c27f04082f4d386e26823_JaffaCakes118
Size

5KB
MD5

acc4d97dae4c27f04082f4d386e26823
SHA1

925238691b19055c337b90b7f0bdff40d455fd58
SHA256

b1ac90902d3b976a47abebd21b87342417b4ded43401fecc0d4cd4a6131a6f38
SHA512

e19137dc56e0112d2f7d72bb133dcac061b59f7e0353dc0836bd0d93fe6e3ef97623b4c19b318658b92d54b2d4833fb4552f9a696f12058832d7d478f05dc4c9
SSDEEP

48:q8++uWanbKgwbSZYOYkwAkIbDL5i/eTgwiVLo/vR4:5a3wbSGu9bDL5ilU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
acc4d97dae4c27f04082f4d386e26823_JaffaCakes118

Files

acc4d97dae4c27f04082f4d386e26823_JaffaCakes118
.dll windows:5 windows x86 arch:x86

7ba58d4f1daabcedc5c5612e53c1b6a9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

IofCompleteRequest
ObfDereferenceObject
ZwClose
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsLookupProcessByProcessId
MmIsAddressValid
ZwOpenProcess
KeServiceDescriptorTable
ExAllocatePoolWithTag
memset
memcpy
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ