f6daa22e30bd2f2eb770f2b2dcc88dc2_JaffaCakes118

General

Target

f6daa22e30bd2f2eb770f2b2dcc88dc2_JaffaCakes118
Size

73KB
MD5

f6daa22e30bd2f2eb770f2b2dcc88dc2
SHA1

b0c461d5b392629c1745394e4e30b2e8881dff87
SHA256

e2ecfbab512d89b2bbae6c4e76324c9023b86eb10e625d479ca769e2fd614fed
SHA512

ae4c726e8b2c0c24d15a935ef4f08017f49ba6879ede34d8b5be192ee1d38287ab360ce36b24f339d2f3c4be8e9c67fac56ee06844d05a5cd8ddc88b0b46c745
SSDEEP

1536:kTQ/idZjoDeGkiP7wQrRRdFSqqLRORvwpRQ:kTQ/iXjoSGkAbNRXtqL4OS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f6daa22e30bd2f2eb770f2b2dcc88dc2_JaffaCakes118

Files

f6daa22e30bd2f2eb770f2b2dcc88dc2_JaffaCakes118
.dll windows:5 windows x86 arch:x86

5415d4c7c0522370c3bae89b6de45c77

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

X:\OoZjiwb\edyylzmgpyfPA\wjnsyBRhLh\yiQkdovqjqtgaW.pdb

Imports

ntoskrnl.exe

RtlInsertUnicodePrefix
SeImpersonateClientEx
RtlAreBitsSet
CcPinMappedData
IoFreeMdl
MmUnmapReservedMapping
RtlCompareUnicodeString
KeReleaseMutex
CcUninitializeCacheMap
IoGetDeviceProperty
IoRemoveShareAccess
RtlNtStatusToDosError
SeCaptureSubjectContext
KeLeaveCriticalRegion
PoCallDriver
IoSetHardErrorOrVerifyDevice
ZwSetValueKey
IofCompleteRequest
KeTickCount
RtlPrefixUnicodeString
ZwCreateKey
RtlInitializeUnicodePrefix
RtlFindLeastSignificantBit
IoGetTopLevelIrp
RtlWriteRegistryValue
IoVerifyPartitionTable
IoCheckEaBufferValidity
IoWMIRegistrationControl
KeGetCurrentThread
KeEnterCriticalRegion
ExDeleteResourceLite
RtlTimeToSecondsSince1970
FsRtlIsHpfsDbcsLegal
CcRepinBcb
KeCancelTimer
ExAllocatePool
MmUnsecureVirtualMemory
ExSetResourceOwnerPointer
ObfReferenceObject
RtlValidSid
ExVerifySuite
RtlCreateSecurityDescriptor
RtlFreeAnsiString
ProbeForRead
IoSetPartitionInformationEx
ObReferenceObjectByPointer
IoReleaseVpbSpinLock
RtlAnsiCharToUnicodeChar
RtlDelete
IoGetAttachedDevice
MmSetAddressRangeModified
IoAllocateErrorLogEntry
CcPreparePinWrite

Exports

Exports

?IsCommandLine@@YGXI<V
?RemoveSystemExW@@YGPAXPAHK<V
?SetSectionA@@YGIMGJ<V
?PutDialogOriginal@@YGXE<V
?RemoveRect@@YGDKPA_N<V
?DecrementDirectoryOriginal@@YGGPAKPAEH<V

Sections

.text
Size: 64KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5415d4c7c0522370c3bae89b6de45c77

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 64KB - Virtual size: 83KB

.text
Size: 64KB - Virtual size: 83KB