cea9e91e55ecd950d69a768c0295fcc9_JaffaCakes118

General

Target

cea9e91e55ecd950d69a768c0295fcc9_JaffaCakes118
Size

32KB
MD5

cea9e91e55ecd950d69a768c0295fcc9
SHA1

004b7ce7bd313480ca60ee2da769ab97aaedf688
SHA256

6c084de6f945283edfc0ca43ee4c4a349c1b3ccfb840b7e9a3aff0e9e9d4a050
SHA512

7e50421513b59b437adb3220ac928096ed87ad7bef064135dc2953b66ae08e0bfce34048902a28dce6aaa60cc375fbaff61ae366d2f184fc516b2e58ea9398de
SSDEEP

768:ykMdbYRhUtsAHkg1IqgG+dOI24ht99LIuibZWdL:yNYRmtTIdCu1UuibA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cea9e91e55ecd950d69a768c0295fcc9_JaffaCakes118

Files

cea9e91e55ecd950d69a768c0295fcc9_JaffaCakes118
.dll windows:5 windows x86 arch:x86

78c3dbde9738dc077af586666b1e6657

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

S:\lIxWsj\GbNc\jqCvFx.pdb

Imports

ntoskrnl.exe

KeRundownQueue
MmCanFileBeTruncated
ExGetSharedWaiterCount
RtlEqualString
FsRtlCheckLockForWriteAccess
KeInsertByKeyDeviceQueue
RtlTimeToSecondsSince1970
RtlAreBitsClear
MmUnlockPagableImageSection
strchr
RtlEqualUnicodeString
RtlUnicodeToMultiByteN
RtlInitString
RtlInitUnicodeString
KdDisableDebugger
ZwOpenKey
RtlCompareString
RtlInitializeSid
IoGetDriverObjectExtension
KeSetKernelStackSwapEnable
MmUnmapIoSpace
RtlGetVersion

Exports

Exports

?GXSKXKZXTR___k_mx__@@YGPAIGPAK@Z
?zxonwYXLp@@YGJDH@Z
?q_nLWGHJLHA@@YG_NND@Z
?cd___resDMTJCJIND@@YGMPANPAK@Z
?EVOMQZdpph_x_ooND@@YGDPAE@Z
?___R_IOY__H__IGCrti@@YGPADJ@Z
?EBGEPDFDX_ADMPL@@YGPAGK@Z
?zjwwvv_haibkuYF@@YGPAEII@Z
?sppENLZ__GOZCMO@@YGKGPA_N@Z
?WGZ_wd_kQHJ__EKj@@YGFD@Z

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.INIT
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 764B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

78c3dbde9738dc077af586666b1e6657

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 9KB

.INIT Size: 17KB - Virtual size: 17KB

.rdata Size: 1024B - Virtual size: 764B

.data Size: 1KB - Virtual size: 65KB

.rsrc Size: 512B - Virtual size: 16B

.reloc Size: 1024B - Virtual size: 864B

.text
Size: 9KB - Virtual size: 9KB

.INIT
Size: 17KB - Virtual size: 17KB

.rdata
Size: 1024B - Virtual size: 764B

.data
Size: 1KB - Virtual size: 65KB

.rsrc
Size: 512B - Virtual size: 16B

.reloc
Size: 1024B - Virtual size: 864B