a965e4a1222d29bca00f355f2cda0556_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a965e4a1222d29bca00f355f2cda0556_JaffaCakes118
Size

5KB
MD5

a965e4a1222d29bca00f355f2cda0556
SHA1

3562e1de8ed181c4a6df6f702893e8a465bbe466
SHA256

fce2bf5717c9e2eb4f087d02ce49fbb2b848409e923329bc033d3c20fcfa6c45
SHA512

5ea3cf0ae7cc85064eb49a70c1da9f3478012bb4f7000ec1574ae4db70412b80b430820287646441ec2084cd006fe130490fdb80c9619852c3124313b583488f
SSDEEP

96:emjaOzbSrtCOnb+ltI+Udvt0fs/JDAlo3:eSzbb6b+PIvdvtcmDv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a965e4a1222d29bca00f355f2cda0556_JaffaCakes118

Files

a965e4a1222d29bca00f355f2cda0556_JaffaCakes118
.dll windows:5 windows x86 arch:x86

3310eb3528ee14b8fb7efcec7c2edce5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

IofCompleteRequest
ObfDereferenceObject
ZwClose
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsLookupProcessByProcessId
MmIsAddressValid
ZwOpenProcess
KeServiceDescriptorTable
ExAllocatePoolWithTag
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 186B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ