dee83af2dab668f7d0379786b2af55ea_JaffaCakes118

General

Target

dee83af2dab668f7d0379786b2af55ea_JaffaCakes118
Size

51KB
MD5

dee83af2dab668f7d0379786b2af55ea
SHA1

0ca22977e43257f7a50ddb57d0f1b2ce8f2a93ef
SHA256

f7e8125990a823222d11376d6a5fce6eb6d7e26ad2c1fd5ded3353f55dba42b6
SHA512

8d28af2d2bf9abbfaad462189610de43c3690e9b8043df7b2691503d13ce0c2a358648aacb1ad7c7e334cb0fed54dc93fbbf2d8ab7bbc860d8ad8a21f2b24e9e
SSDEEP

768:jV6iUSLhCeubN5c+hrOFL+RogMqOBSzfAREvjchVf8+huCudwR:YSnubN5cQ6F6RogMCfAeWCL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dee83af2dab668f7d0379786b2af55ea_JaffaCakes118

Files

dee83af2dab668f7d0379786b2af55ea_JaffaCakes118
.dll windows:5 windows x86 arch:x86

17e65ae5ad75ccb1582ee4632e52a26b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

O:\akKqrwvDLqnIdsdm\LsfsqkxjudCHavAmyuee\gtwpukSJauMx\AhhsozoifboUBSB\bdUzjKqdzJlFBubhyQ\hShwvowuaaTDe\qbXfdgtcWkyGBbIgpxeAge.pdb

Imports

ntoskrnl.exe

KeSetBasePriorityThread
KeStackAttachProcess
PsLookupProcessByProcessId
KeSynchronizeExecution
RtlInitUnicodeString
ZwOpenSymbolicLinkObject
RtlAreBitsClear
KeRegisterBugCheckCallback
KeInitializeTimer
FsRtlCheckOplock
RtlIntegerToUnicodeString
IoGetStackLimits
ZwOpenSection
IoDeleteSymbolicLink
RtlCharToInteger
RtlInitString
RtlEqualString
IoStartPacket
FsRtlFastCheckLockForRead
ExAllocatePoolWithQuotaTag
RtlCompareString
MmHighestUserAddress
RtlEqualUnicodeString
ExAcquireFastMutexUnsafe
ZwOpenProcess
IoSetDeviceInterfaceState
RtlUnicodeToOemN
MmUnmapLockedPages

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 1024B - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 708B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

17e65ae5ad75ccb1582ee4632e52a26b

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 14KB - Virtual size: 13KB

.itext Size: 1024B - Virtual size: 64KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 9KB - Virtual size: 8KB

.rsrc Size: 512B - Virtual size: 16B

.reloc Size: 1024B - Virtual size: 708B

.text
Size: 14KB - Virtual size: 13KB

.itext
Size: 1024B - Virtual size: 64KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 512B - Virtual size: 16B

.reloc
Size: 1024B - Virtual size: 708B