af7e3e5dc2c5ae5330c13e0760ed8d50_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

af7e3e5dc2c5ae5330c13e0760ed8d50_JaffaCakes118
Size

55KB
MD5

af7e3e5dc2c5ae5330c13e0760ed8d50
SHA1

8b288e5c0b0d9ba7ffb2a5c8dc7beb80b3255be9
SHA256

4cfb0cd05108e9a2680127a1e19abe5822e535034bd85339bbad752173025bf6
SHA512

4d670401733467c0b5f3793399d3f3d702ee9baf8e557de9b7b4b209970d7f10c5dc563a66b373d1fd97ee13a0f4ca90c480c8febf3eb14e249d681eeb7ee87c
SSDEEP

1536:Hq7dotWaFimR7f8v/Q+1Hy5bNUYjxva7Cf6:sdkJ7kv/QuaiWMm6

Score

1^/10

Malware Config

Signatures

Files

af7e3e5dc2c5ae5330c13e0760ed8d50_JaffaCakes118
.sys windows:5 windows x86 arch:x86

b8d680a0747c3b39ec363465eaeeb46e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26/01/2010, 00:00

Not After

25/01/2013, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

8a:2e:76:05:d9:74:cf:b4:45:8b:30:69:85:17:8a:9b:fa:d6:47:84
Signer

Actual PE Digest

8a:2e:76:05:d9:74:cf:b4:45:8b:30:69:85:17:8a:9b:fa:d6:47:84

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\qqpcmgr_proj\QQPCMgr_safe_trunk\FTSafe\Drivers\AFKernel\intelx86\fre\QQSysMon.pdb

Imports

ntoskrnl.exe

PsThreadType
ExAcquireResourceSharedLite
ExReleaseResourceLite
ExDeleteResourceLite
ExInitializeResourceLite
ExAcquireResourceExclusiveLite
memmove
KeLeaveCriticalRegion
_wcsnicmp
ZwQueryObject
KeEnterCriticalRegion
ZwCreateFile
ZwQuerySymbolicLinkObject
wcsncpy
MmGetSystemRoutineAddress
wcsncat
ZwOpenSymbolicLinkObject
_wcslwr
ZwOpenDirectoryObject
ObQueryNameString
IoDriverObjectType
ExAllocatePool
MmIsThisAnNtAsSystem
ZwQueryDirectoryObject
KeSetTimer
RtlCompareMemory
ObfReferenceObject
ObReferenceObjectByName
KeInitializeTimerEx
ObOpenObjectByPointer
RtlVolumeDeviceToDosName
ExFreePoolWithTag
wcschr
IoThreadToProcess
_snwprintf
IoGetCurrentProcess
ZwOpenProcess
ZwQueryInformationProcess
PsProcessType
RtlCopyUnicodeString
ZwTerminateProcess
PsLookupProcessByProcessId
_wcsupr
RtlUpcaseUnicodeChar
wcsncmp
KeInitializeQueue
KeBugCheckEx
ObReferenceObjectByHandle
KeGetCurrentThread
KeSetBasePriorityThread
MmQuerySystemSize
KeSetEvent
KeSetPriorityThread
KeRundownQueue
KeInsertQueue
KeWaitForMultipleObjects
KeRemoveQueue
ExAllocatePoolWithTag
ExInitializeNPagedLookasideList
KeBugCheck
ZwClose
IoGetDeviceObjectPointer
PsCreateSystemThread
InterlockedPushEntrySList
_wcsicmp
ExDeleteNPagedLookasideList
InterlockedPopEntrySList
DbgPrint
KeInitializeEvent
ObfDereferenceObject
MmIsAddressValid
PsGetCurrentProcessId
KeWaitForSingleObject
RtlInitUnicodeString
memset
memcpy
_except_handler3

hal

ExAcquireFastMutex
KfReleaseSpinLock
ExReleaseFastMutex
KfAcquireSpinLock
KeGetCurrentIrql

fltmgr.sys

FltSendMessage
FltQueryInformationFile
FltSetInformationFile
FltParseFileNameInformation
FltReleaseFileNameInformation
FltGetFileNameInformation
FltGetDestinationFileNameInformation
FltAllocateContext
FltSetStreamHandleContext
FltReleaseContext
FltGetStreamContext
FltFreeSecurityDescriptor
FltGetStreamHandleContext
FltStartFiltering
FltRegisterFilter
FltBuildDefaultSecurityDescriptor
FltCreateCommunicationPort
FltCloseCommunicationPort
FltUnregisterFilter
FltCloseClientPort
FltSetStreamContext
FltCancelFileOpen

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 832B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b8d680a0747c3b39ec363465eaeeb46e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0Certificate

Extended Key Usages

Key Usages

8a:2e:76:05:d9:74:cf:b4:45:8b:30:69:85:17:8a:9b:fa:d6:47:84Signer

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

fltmgr.sys

Sections

.text Size: 34KB - Virtual size: 34KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 6KB - Virtual size: 6KB

INIT Size: 3KB - Virtual size: 3KB

.rsrc Size: 832B - Virtual size: 808B

.reloc Size: 2KB - Virtual size: 2KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

8a:2e:76:05:d9:74:cf:b4:45:8b:30:69:85:17:8a:9b:fa:d6:47:84
Signer

.text
Size: 34KB - Virtual size: 34KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 6KB - Virtual size: 6KB

INIT
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 832B - Virtual size: 808B

.reloc
Size: 2KB - Virtual size: 2KB