ce6f6751e604d6d93817d6bf99cbdbf9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ce6f6751e604d6d93817d6bf99cbdbf9_JaffaCakes118
Size

32KB
MD5

ce6f6751e604d6d93817d6bf99cbdbf9
SHA1

54c4b6697235f10be489b015bb0518b22a1747a9
SHA256

e5d1e6bc6805af619893d5cfe99b52dff0a46cca9b4ef4ac56e7f16eae391a77
SHA512

0388d4c28722a2ebd9ced71cb0bb25222ec7a14c80674203b5a8b7e3957ff48e24642d5fc2c2ea84377bca679c7d71f8f89f811a278de04d32d753d491e990c9
SSDEEP

768:gHaITfTAT35WVaaxCG7WmKSPYx7GNQUzeasZO1zY:6a0LVf0GJBU7GCUbR1z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ce6f6751e604d6d93817d6bf99cbdbf9_JaffaCakes118

Files

ce6f6751e604d6d93817d6bf99cbdbf9_JaffaCakes118
.dll windows:4 windows x86 arch:x86

2ea0677b19d8af7b5913998347e66057

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

ZwDeleteFile
ZwOpenFile
MmGetSystemRoutineAddress

hal

HalDisplayString
KeRaiseIrql

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ