bcde56bd56a998e71c5bff89d70337f4_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

bcde56bd56a998e71c5bff89d70337f4_JaffaCakes118
Size

267KB
MD5

bcde56bd56a998e71c5bff89d70337f4
SHA1

88011be4084aa9c6b341293195cba743adb6f200
SHA256

dc54df78d837b361de859bd3792c9a416b98e446ae9fd905ef9e188e9e34860d
SHA512

77ec9a3c63a0af2ce8ee01bd03a2bdd7d0fd57b5e5af49d484d9c9a9aebb6cfa30e9446a75089a45475d48fd8ba371fe7796b50f999bf2e5b6a3f31c7792578c
SSDEEP

6144:R3vYokd7ws+n3xId55FUIgtgnKIw+/qIKtwyCGqob:Rf1qULxId55FUIgtr0K6yClob

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bcde56bd56a998e71c5bff89d70337f4_JaffaCakes118

Files

bcde56bd56a998e71c5bff89d70337f4_JaffaCakes118
.dll windows:5 windows x86 arch:x86

c1cef9074dd0e5c8dec3eef3f368b3e5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

halmacpi.pdb

Imports

ntoskrnl.exe

KeSaveStateForHibernate
KeUpdateSystemTime
KeUpdateRunTime
Kei386EoiHelper
KdEnteredDebugger
KiIpiServiceRoutine
KeProfileInterrupt
KeSetEventBoostPriority
KeWaitForSingleObject
KiDeliverApc
KiDispatchInterrupt
DbgPrint
KeFindConfigurationNextEntry
ExFreePoolWithTag
ExAllocatePoolWithTag
ZwQueryValueKey
RtlInitUnicodeString
RtlIntegerToUnicodeString
ZwClose
RtlEqualUnicodeString
ZwOpenKey
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlUpperString
RtlInitAnsiString
sprintf
ZwCreateKey
ZwSetValueKey
IoAssignDriveLetters
IoReadPartitionTable
IoSetPartitionInformation
IoWritePartitionTable
strncpy
_stricmp
InbvAcquireDisplayOwnership
InbvCheckDisplayOwnership
KiBugCheckData
RtlMoveMemory
KeInitializeSpinLock
MmAllocateMappingAddress
MmUnmapReservedMapping
MmMapLockedPagesWithReservedMapping
MmMapLockedPagesSpecifyCache
MmGetPhysicalAddress
MmAllocateContiguousMemorySpecifyCache
MmFreeContiguousMemory
RtlFindClearBitsAndSet
KeRemoveDeviceQueue
RtlClearBits
ObfDereferenceObject
IoFreeMdl
IoAllocateMdl
_allshr
MmUnmapLockedPages
KeSetEvent
RtlSetBits
IoRegisterPlugPlayNotification
IofCallDriver
IoBuildSynchronousFsdRequest
KeInitializeEvent
IoGetDeviceObjectPointer
IoGetDeviceInterfaces
ExQueueWorkItem
KeBugCheckEx
KeInitializeDpc
KeInsertQueueDpc
KeQuerySystemTime
RtlQueryRegistryValues
KeRevertToUserAffinityThread
KeSetSystemAffinityThread
KeEnterKernelDebugger
KdDebuggerEnabled
KdDebuggerNotPresent
InbvSetScrollRegion
InbvEnableDisplayString
InbvInstallDisplayStringFilter
InbvSetTextColor
InbvSolidColorFill
InbvResetDisplay
InbvIsBootDriverInstalled
ZwEnumerateValueKey
ZwQueryKey
KiAcquireSpinLock
KiReleaseSpinLock
IoAssignResources
IoAllocateAdapterChannel
ObCreateObject
MmUnlockPagableImageSection
MmLockPagableDataSection
MmMapIoSpace
RtlSetAllBits
RtlInitializeBitMap
KeInitializeDeviceQueue
ObInsertObject
ObReferenceObjectByPointer
IoAdapterObjectType
IoDeleteDevice
IoAttachDeviceToDeviceStack
IoCreateDevice
IofCompleteRequest
PoStartNextPowerIrp
ObfReferenceObject
IoReportDetectedDevice
IoCreateDriver
WRITE_REGISTER_UCHAR
PoSetHiberRange
KeSetTargetProcessorDpc
KeSetImportanceDpc
HalPrivateDispatchTable
IoReportHalResourceUsage
KeSetTimeIncrement
MmUnmapIoSpace
MmAllocateContiguousMemory
_except_handler3
RtlTimeFieldsToTime
ZwPowerInformation
ExRegisterCallback
ExCreateCallback
HalDispatchTable
InbvDisplayString
atoi
strstr
KiEnableTimerWatchdog
KeRegisterBugCheckCallback
KeSetProfileIrql
PsGetCurrentProcessId
_aulldiv
_allmul
KeInsertDeviceQueue
DbgBreakPoint

kdcom

KdRestore

Exports

Exports

ExAcquireFastMutex
ExReleaseFastMutex
ExTryToAcquireFastMutex
HalAcquireDisplayOwnership
HalAdjustResourceList
HalAllProcessorsStarted
HalAllocateAdapterChannel
HalAllocateCommonBuffer
HalAllocateCrashDumpRegisters
HalAssignSlotResources
HalBeginSystemInterrupt
HalCalibratePerformanceCounter
HalClearSoftwareInterrupt
HalDisableSystemInterrupt
HalDisplayString
HalEnableSystemInterrupt
HalEndSystemInterrupt
HalFlushCommonBuffer
HalFreeCommonBuffer
HalGetAdapter
HalGetBusData
HalGetBusDataByOffset
HalGetEnvironmentVariable
HalGetInterruptVector
HalHandleNMI
HalInitSystem
HalInitializeProcessor
HalMakeBeep
HalProcessorIdle
HalQueryDisplayParameters
HalQueryRealTimeClock
HalReadDmaCounter
HalReportResourceUsage
HalRequestIpi
HalRequestSoftwareInterrupt
HalReturnToFirmware
HalSetBusData
HalSetBusDataByOffset
HalSetDisplayParameters
HalSetEnvironmentVariable
HalSetProfileInterval
HalSetRealTimeClock
HalSetTimeIncrement
HalStartNextProcessor
HalStartProfileInterrupt
HalStopProfileInterrupt
HalSystemVectorDispatchEntry
HalTranslateBusAddress
IoAssignDriveLetters
IoFlushAdapterBuffers
IoFreeAdapterChannel
IoFreeMapRegisters
IoMapTransfer
IoReadPartitionTable
IoSetPartitionInformation
IoWritePartitionTable
KdComPortInUse
KeAcquireInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLockRaiseToSynch
KeAcquireQueuedSpinLock
KeAcquireQueuedSpinLockRaiseToSynch
KeAcquireSpinLock
KeAcquireSpinLockRaiseToSynch
KeFlushWriteBuffer
KeGetCurrentIrql
KeLowerIrql
KeQueryPerformanceCounter
KeRaiseIrql
KeRaiseIrqlToDpcLevel
KeRaiseIrqlToSynchLevel
KeReleaseInStackQueuedSpinLock
KeReleaseQueuedSpinLock
KeReleaseSpinLock
KeStallExecutionProcessor
KeTryToAcquireQueuedSpinLock
KeTryToAcquireQueuedSpinLockRaiseToSynch
KfAcquireSpinLock
KfLowerIrql
KfRaiseIrql
KfReleaseSpinLock
READ_PORT_BUFFER_UCHAR
READ_PORT_BUFFER_ULONG
READ_PORT_BUFFER_USHORT
READ_PORT_UCHAR
READ_PORT_ULONG
READ_PORT_USHORT
WRITE_PORT_BUFFER_UCHAR
WRITE_PORT_BUFFER_ULONG
WRITE_PORT_BUFFER_USHORT
WRITE_PORT_UCHAR
WRITE_PORT_ULONG
WRITE_PORT_USHORT

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INITCONS
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGELK
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGELK16
Size: 256B - Virtual size: 134B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEKD
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c1cef9074dd0e5c8dec3eef3f368b3e5

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

kdcom

Exports

Exports

Sections

.text Size: 35KB - Virtual size: 34KB

.data Size: 41KB - Virtual size: 40KB

INITCONS Size: 512B - Virtual size: 512B

PAGELK Size: 13KB - Virtual size: 13KB

PAGELK16 Size: 256B - Virtual size: 134B

PAGE Size: 11KB - Virtual size: 11KB

PAGEKD Size: 4KB - Virtual size: 4KB

.edata Size: 3KB - Virtual size: 2KB

INIT Size: 15KB - Virtual size: 15KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 140KB - Virtual size: 140KB

.text
Size: 35KB - Virtual size: 34KB

.data
Size: 41KB - Virtual size: 40KB

INITCONS
Size: 512B - Virtual size: 512B

PAGELK
Size: 13KB - Virtual size: 13KB

PAGELK16
Size: 256B - Virtual size: 134B

PAGE
Size: 11KB - Virtual size: 11KB

PAGEKD
Size: 4KB - Virtual size: 4KB

.edata
Size: 3KB - Virtual size: 2KB

INIT
Size: 15KB - Virtual size: 15KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 140KB - Virtual size: 140KB