e249350b14dea2fa605dcca688d25526_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e249350b14dea2fa605dcca688d25526_JaffaCakes118
Size

6KB
MD5

e249350b14dea2fa605dcca688d25526
SHA1

ce6e631f93b4029b9d08e7e18178f4db0574f0ad
SHA256

4290b7705fee3bf055e54ee0dbd71cb36a4b2371d55809bd7d06a22b40a4cd0a
SHA512

52bf551116a1b40abc24805c9e99182f8bb71bf9bd58c31315a4abbbf023ef3f588d3bb5714e7bcfcddd53fe716d09fa68fc5e091d98df5c7e2217337b442a07
SSDEEP

48:iWuFLjMv/xXr9Wz47wcj1HvlTMkHVA49lKludG87lBS5iLRrdr4q/CkQehKby3JN:SHMx9+47wcj1HLA49lKZ0BIs12WMbZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e249350b14dea2fa605dcca688d25526_JaffaCakes118

Files

e249350b14dea2fa605dcca688d25526_JaffaCakes118
.dll windows:4 windows x86 arch:x86

535b93318e4cef26354b945724f0d333

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\VSS\WinFixer2005Scanner\_Release\df_u42.pdb

Imports

ntoskrnl.exe

DbgPrint
IofCompleteRequest
ZwClose
MmMapLockedPages
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ZwOpenFile
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
swprintf
ZwReadFile
_allmul
ZwWriteFile
ZwQueryVolumeInformationFile

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 512B - Virtual size: 450B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 680B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ