eb2d282b68926c3a0a8cab4baae7ee95_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

eb2d282b68926c3a0a8cab4baae7ee95_JaffaCakes118
Size

434KB
MD5

eb2d282b68926c3a0a8cab4baae7ee95
SHA1

260cc99e40ebfde9b52b7235106f307b4cebf8e3
SHA256

4352e6a908f539bbb0f9b78cb5ef1784ee1dbcba726b99545f77b9d4e72a8ef7
SHA512

08da891885a10e0c08ff10b66002a261607e08d3d73e911ea4d9393c2acd0af77699a1ed6b788e94eecebd3d500452db27647ce73e016269ef40a85aadcd826c
SSDEEP

12288:uRHRBLBh//TLZZOBwhm+KPzvYiLeO20H:Mx1/LLZZOam+KPzvYinp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eb2d282b68926c3a0a8cab4baae7ee95_JaffaCakes118

Files

eb2d282b68926c3a0a8cab4baae7ee95_JaffaCakes118
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

ChangeRegOnBP
CreateRemoteAPC
DBKResumeProcess
DBKResumeThread
DBKSuspendProcess
DBKSuspendThread
DebugProcess
GetCR0
GetCR3
GetCR4
GetDebugportOffset
GetGDT
GetIDTCurrentThread
GetIDTs
GetKProcAddress
GetLoadedState
GetPEThread
GetPhysicalAddress
GetProcessNameFromID
GetProcessnameOffset
GetSDT
GetSDTEntry
GetSDTShadow
GetSSDTEntry
GetThreadListEntryOffset
GetThreadsProcessOffset
IlvMoney001
IlvMoney002
IsValidHandle
KernelAlloc
MakeKernelCopy
MakeWritable
NOP
OP
OT
ProtectMe
RPM
ReadPhysicalMemory
RetrieveDebugData
SetCR3
SetGlobalDebugState
SetSDTEntry
SetSSDTEntry
StartProcessWatch
StopDebugging
StopRegisterChange
UnprotectMe
VAE
VQE
WPM
WaitForProcessListData
WritePhysicalMemory
dbvm_block_interrupts
dbvm_changeselectors
dbvm_redirect_interrupt1
dbvm_restore_interrupts
dbvm_version
getAlternateDebugMethod
setAlternateDebugMethod
test
useIOCTL

Sections

CODE
Size: 375KB - Virtual size: 374KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 375KB - Virtual size: 374KB

DATA Size: 4KB - Virtual size: 4KB

BSS Size: - Virtual size: 3KB

.idata Size: 9KB - Virtual size: 8KB

.edata Size: 1KB - Virtual size: 1KB

.reloc Size: 23KB - Virtual size: 22KB

.rsrc Size: 20KB - Virtual size: 20KB

CODE
Size: 375KB - Virtual size: 374KB

DATA
Size: 4KB - Virtual size: 4KB

BSS
Size: - Virtual size: 3KB

.idata
Size: 9KB - Virtual size: 8KB

.edata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 23KB - Virtual size: 22KB

.rsrc
Size: 20KB - Virtual size: 20KB