aa3b62cd492c205c097d3cbc87ee28f4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

aa3b62cd492c205c097d3cbc87ee28f4_JaffaCakes118
Size

60KB
MD5

aa3b62cd492c205c097d3cbc87ee28f4
SHA1

3cb131ba7e9815bfaf36e9017ed364abd685114d
SHA256

4789b6bda2c4a604803f213b5fc2ff18bcf3afea0720e347710f1365e572edac
SHA512

94dfc74869ad86bca5d48cb12dd4f18d5d334419d4dc4b7bb46241c8f764e4567d975d65e41e3609b16fa709802af4df35fae08e499543c0482ae68ec84d425d
SSDEEP

768:L9htYuxxMz4m/0+m45dC66lsgrgipeaddlrTpEMaqZFI6rF2zRb1sueIxz9IsSnH:jVSzqiAls+gi0wvphy8F2zRb1suL9cH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa3b62cd492c205c097d3cbc87ee28f4_JaffaCakes118

Files

aa3b62cd492c205c097d3cbc87ee28f4_JaffaCakes118
.dll windows:4 windows x86 arch:x86

65bb2bf013e2a1448c9d69194be70193

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

hal

KeQueryPerformanceCounter

ntoskrnl.exe

KeGetCurrentThread
KeInitializeTimer
MmQuerySystemSize
memcpy
memset
PsGetCurrentProcessId
IoGetCurrentProcess
KeTickCount
KeInitializeMutex
PsGetCurrentThreadId
KeQueryActiveProcessors
KeInitializeSpinLock
PsGetVersion

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 640B - Virtual size: 633B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128B - Virtual size: 14B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 512B - Virtual size: 426B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 896B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ