d23656a4dd66f73b919e23ee44061af9_JaffaCakes118

General

Target

d23656a4dd66f73b919e23ee44061af9_JaffaCakes118
Size

42KB
MD5

d23656a4dd66f73b919e23ee44061af9
SHA1

29216d7ff371bd13af10360cee0db800ed7e9884
SHA256

b4dc3075ed3e50d3ea40ab51abb2cf9282b03df38b6156f4a92017a78c78ed7d
SHA512

8ff0445172c31853b494b2a5c49e32301138c592ab9b7058f8668bf445544d30d367b699061ba6eb244bc08bf521d34bc41eb084907239cb15e05bdce1a9a85d
SSDEEP

768:1a9mDtR8bnCufbohWtPkjHChm+fNSxSOaiVXEQ:1aCtRkCuzcWPklw5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d23656a4dd66f73b919e23ee44061af9_JaffaCakes118

Files

d23656a4dd66f73b919e23ee44061af9_JaffaCakes118
.dll windows:5 windows x86 arch:x86

dbe2e5c5006049dc331fa1df015f7e33

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

O:\zesc\URcCvImt\YNjTi.pdb

Imports

ntoskrnl.exe

RtlGetNextRange
RtlCompareMemory
MmSizeOfMdl
ExDeletePagedLookasideList
IoDeviceObjectType
RtlCopyLuid
RtlxUnicodeStringToAnsiSize
ObGetObjectSecurity
RtlSecondsSince1970ToTime
RtlLengthRequiredSid
FsRtlNotifyInitializeSync
IoReleaseCancelSpinLock
RtlSubAuthoritySid
RtlFindLongestRunClear
KeWaitForSingleObject
IoWriteErrorLogEntry
IoReportResourceForDetection
ProbeForRead
ZwMapViewOfSection
RtlAddAccessAllowedAceEx
IoGetBootDiskInformation
RtlEqualUnicodeString
RtlEnumerateGenericTable
CcZeroData

Exports

Exports

?YHkGogwuhWpWcwwne@@YGPAXPAHG@Z
?vqwkpdVmNH@@YGMGPAF@Z
?mnwzRGbkdqjZiVqc@@YGFPAM@Z
?ftaMhbvHoCoMikde@@YG_NPAHPAD@Z
?bEicdyg@@YGDI@Z
?luaPhlqw@@YGEPAE@Z
?leAYpgbvqbTSPunpEvI@@YGPAD_N@Z

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 311B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dbe2e5c5006049dc331fa1df015f7e33

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 8KB

.edata Size: 512B - Virtual size: 311B

.data Size: 2KB - Virtual size: 18KB

INIT Size: 9KB - Virtual size: 9KB

.rsrc Size: 19KB - Virtual size: 19KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 9KB - Virtual size: 8KB

.edata
Size: 512B - Virtual size: 311B

.data
Size: 2KB - Virtual size: 18KB

INIT
Size: 9KB - Virtual size: 9KB

.rsrc
Size: 19KB - Virtual size: 19KB

.reloc
Size: 2KB - Virtual size: 1KB