afa2e7ecc8be6cbf2f64ecdbd5aa1727_JaffaCakes118 | Triage

Sharing

General

Target

afa2e7ecc8be6cbf2f64ecdbd5aa1727_JaffaCakes118
Size

5KB
MD5

afa2e7ecc8be6cbf2f64ecdbd5aa1727
SHA1

5d220afffc40569bd5bd23d681e6697c15e83db5
SHA256

ef31366a42f5d6bf97c6b17b271548121cba36007c643dda87ef428faa39793e
SHA512

b0c718d2df011e8fd1f6604c46d86b4c1d403a0346ad7d62c177534c2a3941d46f2fd0a9a27efa8ed0a4137371493dab0a3810a051a073f7302f068539eb837c
SSDEEP

96:6As64RFFPhc01nbnoMjYwl2aqaCyQhfABWwpcLajkSq:lme0RD0wE/hfqx3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
afa2e7ecc8be6cbf2f64ecdbd5aa1727_JaffaCakes118

Files

afa2e7ecc8be6cbf2f64ecdbd5aa1727_JaffaCakes118
.dll windows:5 windows x86 arch:x86

90ca042ace32bf194a0dda8e2ec06446

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\ADPlus2010\ADPlus5.0\Setup2.0\miniDriver\Check\MiniDriver.pdb

Imports

ntoskrnl.exe

ZwClose
PsCreateSystemThread
RtlDeleteRegistryValue
RtlWriteRegistryValue
RtlCreateRegistryKey
ZwWriteFile
ExFreePoolWithTag
ZwReadFile
ExAllocatePoolWithTag
ZwQueryInformationFile
ZwCreateFile
RtlRandom
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlGetVersion
PsTerminateSystemThread
RtlFreeUnicodeString
ZwLoadDriver
RtlAppendUnicodeStringToString
RtlQueryRegistryValues
KeDelayExecutionThread

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 213B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 128B - Virtual size: 50B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 640B - Virtual size: 596B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 138B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ