e15c2a9e2448e572a58a7e69ccb8140a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

e15c2a9e2448e572a58a7e69ccb8140a_JaffaCakes118
Size

218KB
MD5

e15c2a9e2448e572a58a7e69ccb8140a
SHA1

fee5956dcac6c2e6f51a7da6475ca604006ca5ec
SHA256

637cb82362f58bf321910e22a97bb57df497da5b4bfa3bd6b8948c6da627b70c
SHA512

b6a1d976c7f57f2d320944906a0b2fb1c17b326703cd1248bd7bae668583731a2107768c5f2cb6afe0b9c401255e17bdd371fd6911ea063153945f14e4a35d73
SSDEEP

6144:AwrYpeCl1IkzOJ/1/p/SYNNiXZCXL7s1WJpES2q:AAYpJANhjbiI7o10ES5

Score

1^/10

Malware Config

Signatures

Files

e15c2a9e2448e572a58a7e69ccb8140a_JaffaCakes118
.sys windows:6 windows x64 arch:x64

de6fa03aa1a614a5a4f3b3854d088759

Code Sign

61:03:dc:f6:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:12

Not After

25/07/2011, 19:22

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:01:e1:a1:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/12/2008, 22:12

Not After

12/03/2010, 22:22

Subject

CN=Microsoft Windows,OU=AOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

79:ad:16:a1:4a:a0:a5:ad:4c:73:58:f4:07:13:2e:65
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

09/05/2001, 23:19

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15/09/2005, 21:55

Not After

15/03/2016, 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

b5:47:bf:af:dc:35:36:7a:fa:51:43:54:01:bc:f4:35:b6:c2:a9:37
Signer

Actual PE Digest

b5:47:bf:af:dc:35:36:7a:fa:51:43:54:01:bc:f4:35:b6:c2:a9:37

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

mcupdate_GenuineIntel.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString
RtlIntegerToUnicodeString
ZwSetValueKey
MmUnlockPagableImageSection
ZwClose
RtlAppendUnicodeStringToString
MmLockPagableSectionByHandle
RtlCopyUnicodeString
MmLockPagableDataSection
ZwOpenKey
KeBugCheckEx

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 332B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGEUPDT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGELK
Size: 200KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 512B - Virtual size: 508B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

de6fa03aa1a614a5a4f3b3854d088759

Code Sign

61:03:dc:f6:00:00:00:00:00:0cCertificate

Extended Key Usages

Key Usages

61:01:e1:a1:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

79:ad:16:a1:4a:a0:a5:ad:4c:73:58:f4:07:13:2e:65Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:07:02:dc:00:00:00:00:00:0bCertificate

Extended Key Usages

Key Usages

b5:47:bf:af:dc:35:36:7a:fa:51:43:54:01:bc:f4:35:b6:c2:a9:37Signer

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 1KB - Virtual size: 1KB

.rdata Size: 512B - Virtual size: 332B

.data Size: 512B - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 168B

PAGEUPDT Size: 1KB - Virtual size: 1KB

PAGE Size: 1KB - Virtual size: 1KB

PAGELK Size: 200KB - Virtual size: 200KB

INIT Size: 512B - Virtual size: 508B

.rsrc Size: 2KB - Virtual size: 2KB

61:03:dc:f6:00:00:00:00:00:0c
Certificate

61:01:e1:a1:00:00:00:00:00:08
Certificate

79:ad:16:a1:4a:a0:a5:ad:4c:73:58:f4:07:13:2e:65
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:07:02:dc:00:00:00:00:00:0b
Certificate

b5:47:bf:af:dc:35:36:7a:fa:51:43:54:01:bc:f4:35:b6:c2:a9:37
Signer

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 512B - Virtual size: 332B

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 168B

PAGEUPDT
Size: 1KB - Virtual size: 1KB

PAGE
Size: 1KB - Virtual size: 1KB

PAGELK
Size: 200KB - Virtual size: 200KB

INIT
Size: 512B - Virtual size: 508B

.rsrc
Size: 2KB - Virtual size: 2KB