a8c8a8ae5595f45a1ec2dc672ecebd5a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a8c8a8ae5595f45a1ec2dc672ecebd5a_JaffaCakes118
Size

66KB
MD5

a8c8a8ae5595f45a1ec2dc672ecebd5a
SHA1

7fc459870bcb47a19b8dc1cc7e00e95f490a4af9
SHA256

ab87ed45b981d845456b00c7826f043a1f2a6994ae0052f1a4be8cc5746c8445
SHA512

d36215806f9bf3f4ba0f51a7926fa1931da1b78a8b5ccadf1147cc1690a54cb51d9a399bfe88c5be4457fcda017fea7cf5a436a475e1fcae18b5290b757321f0
SSDEEP

1536:GCdV9lbtEjWFe/mbPPZytER9Sdx30I9Mm9/kpao/EWbLo:5L0IpPZ7R9A3fMakpao/BH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a8c8a8ae5595f45a1ec2dc672ecebd5a_JaffaCakes118

Files

a8c8a8ae5595f45a1ec2dc672ecebd5a_JaffaCakes118
.dll windows:4 windows x86 arch:x86

1724926f250d74e57ae202d8155c470b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

hal

KeQueryPerformanceCounter

ntoskrnl.exe

KeTickCount
PsGetCurrentThreadId
KeInitializeTimer
KeInitializeMutex
KeInitializeEvent
IoGetCurrentProcess
KeGetCurrentThread
PsGetVersion
MmQuerySystemSize
KeQueryActiveProcessors
memcpy
memset
PsGetCurrentProcessId
KeInitializeSpinLock

Sections

.text
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384B - Virtual size: 340B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128B - Virtual size: 14B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 512B - Virtual size: 450B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 896B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ