be69d7b26ca88bfe9fb50ff98327bb93_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

be69d7b26ca88bfe9fb50ff98327bb93_JaffaCakes118
Size

6KB
MD5

be69d7b26ca88bfe9fb50ff98327bb93
SHA1

f9e4983250f12e0a344b2d662e47e9c83814bd45
SHA256

b017d48086ecc32ec37cb108b62173f6636f0f5514d872d4296350f621a0d0f7
SHA512

4ea3394b22525592b77130979cf1ce58ff584cdbe4afd181bd862240bd08a3157fc4f11264efdf3b85fb0d299bb804eb5cbeed1756c5c17d424e18510f724b6d
SSDEEP

96:06KcrD8H2QnonRa+FPHJB1n+Didi2IRyOYmnKFaTsPy+cApxppVSz:0uD8WQIImpBRGi9I0/mKVpxH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be69d7b26ca88bfe9fb50ff98327bb93_JaffaCakes118

Files

be69d7b26ca88bfe9fb50ff98327bb93_JaffaCakes118
.dll windows:5 windows x86 arch:x86

e610606a11a87777a4b7b6452a47757a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\ADPlus2010\ADPlus5.0\Setup2.0\miniDriver\Check\MiniDriver.pdb

Imports

ntoskrnl.exe

ZwClose
PsCreateSystemThread
RtlDeleteRegistryValue
RtlWriteRegistryValue
RtlCreateRegistryKey
ZwWriteFile
ExFreePoolWithTag
ZwReadFile
ExAllocatePoolWithTag
ZwQueryInformationFile
ZwCreateFile
RtlRandom
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlGetVersion
PsTerminateSystemThread
ZwLoadDriver
RtlAppendUnicodeStringToString
RtlQueryRegistryValues
KeDelayExecutionThread

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 213B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 128B - Virtual size: 50B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 640B - Virtual size: 568B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ