b89a0d8059dcc538d36e185b1365890e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b89a0d8059dcc538d36e185b1365890e_JaffaCakes118
Size

445KB
MD5

b89a0d8059dcc538d36e185b1365890e
SHA1

639d22e498661b21b6edcc9c41f5f288d1eff89f
SHA256

42ca0ba63e5feed308994adf29e510c08cf92223683296d6e044d11ba0992eaa
SHA512

66cffce868abe8ded4249f4112ca99b66c556fe2a36a6e267a48676c1f84b61a485cf09a64984a3e0703133399739996e76b613414aa8cbff1abac6b9a98445a
SSDEEP

12288:j4h33/BtKy4LE4wxubJ2Li73ZpjgRdKWQ:j4NPiW/MbJ2LO3ZpkRIx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b89a0d8059dcc538d36e185b1365890e_JaffaCakes118

Files

b89a0d8059dcc538d36e185b1365890e_JaffaCakes118
.dll windows:5 windows x86 arch:x86

7942b9ffa15ae749d6ff5cc0145d1240

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Q:\hcvhfFaW\lzjixnt\agnpywkSttcm\fETxLhjZcmqz.pdb

Imports

ntoskrnl.exe

RtlInitString
ZwMapViewOfSection
ZwQuerySymbolicLinkObject
KeRemoveByKeyDeviceQueue
RtlEqualUnicodeString
CcFastMdlReadWait
KeInsertDeviceQueue
ZwQueryInformationFile
PsGetCurrentThread
SeDeassignSecurity
RtlInitUnicodeString
RtlEqualSid
FsRtlCheckLockForReadAccess
RtlEqualString
SeImpersonateClientEx
RtlDeleteNoSplay
RtlUpperChar
RtlGUIDFromString
KeSetKernelStackSwapEnable
ExDeletePagedLookasideList
RtlUpcaseUnicodeString

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 10KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 716B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ