b18830c379bbec4c7866315544ddc8ab_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b18830c379bbec4c7866315544ddc8ab_JaffaCakes118
Size

70KB
MD5

b18830c379bbec4c7866315544ddc8ab
SHA1

2c0d70e6be44ec78f0b43c7cb3dedba1e606aea5
SHA256

e1edbd90ec2440ecd7cc759b5a1876e2e5c972e56a960b990398a1fb2640a58e
SHA512

28ed8f1e09e3e0664f95a2b02e60f423e4a40f65e5f024093fc23c86682c19ace2cf2315e56b36374978e8fc758c06bf852a180f6a42d08ec4a542ff24926e42
SSDEEP

1536:l6mmAHsxvnVTd3FJ30h4lTb+/uNSJ9QJtNQ1IA:RHMlV5FJIn/uMnuXQ1I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b18830c379bbec4c7866315544ddc8ab_JaffaCakes118

Files

b18830c379bbec4c7866315544ddc8ab_JaffaCakes118
.dll windows:4 windows x86 arch:x86

df577456b4dfe629caebc3ae6cea613e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

ZwDisplayString
IoGetStackLimits
_abnormal_termination
IoReleaseVpbSpinLock
RtlSecondsSince1970ToTime
KeInsertByKeyDeviceQueue
memset
ExInitializePagedLookasideList
RtlGetNtGlobalFlags
KeResetEvent
PoStartNextPowerIrp

hal

IoAssignDriveLetters
WRITE_PORT_ULONG
READ_PORT_BUFFER_USHORT
HalSetBusDataByOffset
HalStartProfileInterrupt
HalDisplayString

Sections

.data
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 535B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ