ba3cf948b0c3195448f6a26769de9a6a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ba3cf948b0c3195448f6a26769de9a6a_JaffaCakes118
Size

140KB
MD5

ba3cf948b0c3195448f6a26769de9a6a
SHA1

8c17aa575ec9221e04f97af19d39ade307ff12cf
SHA256

488e66c876be48d81db27ac6cdf8db9361681742e64c7c8fd429a4d8ea709a7d
SHA512

a4694c92a15736cf6e037ade2ca19bd4c2477921d983cb3eb16144d6ef00b9ff7cdaf63f3917969d4735e3983d16b4adab5ae86269944becc48dce7a856fd370
SSDEEP

3072:yh4AcPXx4upNi7MCUOsUKACX2Pv8u1c8d7HYKrT8UVqcYlnKrmh4BxEgCC:yh7FupNi7MyJc8JH917YlnKrmh4BxEgZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ba3cf948b0c3195448f6a26769de9a6a_JaffaCakes118

Files

ba3cf948b0c3195448f6a26769de9a6a_JaffaCakes118
.exe windows:6 windows x86 arch:x86

0e0ceb9389d4fff9316be0c50d15e193

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\nanoav\trunk\3.x\ts an

Imports

ntoskrnl.ex

memsee
ExFreePoolWithTag
IoWMI1
ExAllocatePoolWithTag
memcpy
MmGetd�3@YARoutVniA
RtlI
RtlCompareMemory
IoWMIRegistrationControl
IofCallDriven
RtlHashS
KeLction
KeEnet�n
RtlCompareS
ZwQueryValueKey
ZwClose-ZwOpenKey
ZwOpenKey
RtlAppendS
RtlCopyS
RtlCreateS
wcsrc
RtlFreeS
KeQueryd�3@YATime
RtlTimeToSecondsSince1980
ExI
ExReleaseResource@Q@YM7
ExAcibuteResourceExclusive@Q@YM�8
ExAcibuteResourceSry [%@Q@YMG
_#
KeTickCountz�KeBugCg: eEx
KeBugCg: eEx
KeI
KeWaitForSing: Object
KeSetEvent
RtlUnwind V
ExI
ExDeletePagedLookasideList
_#
KefAcibuteSpinLockAtDpcLevel
KefReleaseSpinLockFromDpcLevel
KeR
ObfDerrferenceObject
IoBuildDe043ZIoControlRriber_
IoGetDe043ZObjecthcts an
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
memmoio
ZwEnumerateValueKey
ExDeleteNPagedLookasideList
KeClEmrEventM�E
ExI
I1%
ExDeleteResource@Q@YM�cKeTickCountz�KeBugCg: eEx
DbgPrint
RtlAnsiCharToS
RtlTimeFieldsToTime
ZwSetInformanVVVFilt
ZwQueryInformanVVVFilt
Zw1
ZwR
ZwCreateFilt

hal

ExReleaseFa3@Mretx
KeReleaseInStackQueuedSpinLockc
KfReleaseSpinLockcF
KeGetC
KfAcibuteSpinLock
ExAcibuteFa3@Mretx
KeAcibuteInStackQueuedSpinLockc

Sections

.t
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1233.5MB - Virtual size: 1233.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1937.0MB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrcy��
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0e0ceb9389d4fff9316be0c50d15e193

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.ex

hal

Sections

.t Size: 103KB - Virtual size: 103KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 1233.5MB - Virtual size: 1233.5MB

PAGE Size: 1937.0MB - Virtual size: 1KB

INIT Size: 4KB - Virtual size: 4KB

.rsrcy�� Size: 1024B - Virtual size: 912B

.reloc Size: 8KB - Virtual size: 8KB

.t
Size: 103KB - Virtual size: 103KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 1233.5MB - Virtual size: 1233.5MB

PAGE
Size: 1937.0MB - Virtual size: 1KB

INIT
Size: 4KB - Virtual size: 4KB

.rsrcy��
Size: 1024B - Virtual size: 912B

.reloc
Size: 8KB - Virtual size: 8KB