e011fb4831a4ea391a034a9f5ab59a71_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

e011fb4831a4ea391a034a9f5ab59a71_JaffaCakes118
Size

4KB
MD5

e011fb4831a4ea391a034a9f5ab59a71
SHA1

f888e409e037175f78d513417237a2d613dd7cd3
SHA256

8cf14d5cec8460029bd7a3c05a8af6baf48229fb409eb64f6a0cf87a21c7228e
SHA512

fb685fd0728286eb3d69f866744108b640f976dbaeb4caf364856424c371627ea250b8b6d9b6f54b6f72dbae47cfdc947218e09efc9b7858ab056226806dbd1e
SSDEEP

96:sQ8vbyHaED+X8tO5N3LOEWr2lpOWKde03FDtIDQT2DG/5D5H7F:lyO6EKX8tO55fWrCOWD03fTBF

Score

1^/10

Malware Config

Signatures

Files

e011fb4831a4ea391a034a9f5ab59a71_JaffaCakes118
.sys windows:5 windows x86 arch:x86

b3e3fac4ccf8d59eca8cc4daf10edf01

Code Sign

02:9c:d3:9d:52:5f:cc:54:bc:f6:28:40:27:86:5b:59
Certificate

Issuer

CN=Microsoft Corporation

Not Before

07/02/2004, 16:00

Not After

07/02/2010, 16:00

Subject

CN=Microsoft Corporation

8c:e4:64:02:13:38:ac:8b:f0:14:47:67:27:98:fc:12:1b:5d:8a:25
Signer

Actual PE Digest

8c:e4:64:02:13:38:ac:8b:f0:14:47:67:27:98:fc:12:1b:5d:8a:25

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
DbgPrint
IofCompleteRequest
KeServiceDescriptorTable
IoDeleteDevice
IoDeleteSymbolicLink
ProbeForWrite
ProbeForRead
_except_handler3

Sections

.text
Size: 640B - Virtual size: 634B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 160B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 352B - Virtual size: 324B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 96B - Virtual size: 86B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b3e3fac4ccf8d59eca8cc4daf10edf01

Code Sign

02:9c:d3:9d:52:5f:cc:54:bc:f6:28:40:27:86:5b:59Certificate

8c:e4:64:02:13:38:ac:8b:f0:14:47:67:27:98:fc:12:1b:5d:8a:25Signer

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 640B - Virtual size: 634B

.rdata Size: 160B - Virtual size: 148B

.data Size: 32B - Virtual size: 24B

INIT Size: 352B - Virtual size: 324B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 96B - Virtual size: 86B

02:9c:d3:9d:52:5f:cc:54:bc:f6:28:40:27:86:5b:59
Certificate

8c:e4:64:02:13:38:ac:8b:f0:14:47:67:27:98:fc:12:1b:5d:8a:25
Signer

.text
Size: 640B - Virtual size: 634B

.rdata
Size: 160B - Virtual size: 148B

.data
Size: 32B - Virtual size: 24B

INIT
Size: 352B - Virtual size: 324B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 96B - Virtual size: 86B