f995fe6bff6a68f2462f0f52d49b508f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f995fe6bff6a68f2462f0f52d49b508f_JaffaCakes118
Size

773KB
MD5

f995fe6bff6a68f2462f0f52d49b508f
SHA1

90c6eacd8c53a6c709b10b31223960c93bf4c2e6
SHA256

f435068d141cf4c6ed903e7345acb26924cb6959e11dcdb8e518c46fffad5e22
SHA512

691d39a08a0a8793e84e633d1e23422f12cd4b06015a41fbac983a54b8e8ef619fb76647992f14da813d85ca79be03b743dc5827b7aa067a8183299a0716c614
SSDEEP

24576:UpnvdScDdR+n58lvlD/JpyfMzGA+wECynp3eo/YqPwXOacMahMKQ:4dRCmlrycynp3x/CeaKu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f995fe6bff6a68f2462f0f52d49b508f_JaffaCakes118

Files

f995fe6bff6a68f2462f0f52d49b508f_JaffaCakes118
.dll windows:5 windows x86 arch:x86

078a8792ef12271b25cf4c62e1a56c59

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

KeSetEvent
KeReleaseMutex
KeWaitForSingleObject
KeInitializeEvent
KeClearEvent
KeInitializeMutex
ZwClose
ZwLoadDriver
ZwSetValueKey
ZwCreateKey
RtlInitUnicodeString
swprintf
ZwDeleteValueKey
ZwQueryValueKey
ZwOpenKey
wcschr
IofCompleteRequest
ProbeForWrite
ProbeForRead
_except_handler3
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsSetCreateProcessNotifyRoutine
wcstombs
IoRegisterBootDriverReinitialization
IoRegisterShutdownNotification
ObfDereferenceObject
ObReferenceObjectByHandle
ZwOpenFile
IoCreateFile
ZwReadFile
ZwQueryInformationFile
ZwWriteFile
PsTerminateSystemThread
ExAllocatePoolWithTag
ExFreePoolWithTag
PsCreateSystemThread
KeDelayExecutionThread
_allmul
PsGetVersion
MmGetSystemRoutineAddress
ObfReferenceObject
IoGetRelatedDeviceObject
_wcsnicmp
MmSystemRangeStart
MmIsAddressValid
IoGetInitialStack
ObOpenObjectByName
ZwQuerySystemInformation
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
KeInsertQueueApc
KeInitializeApc
PsIsThreadTerminating
IoIsSystemThread
PsLookupThreadByThreadId
MmUserProbeAddress
ZwQueryInformationProcess
KeUnstackDetachProcess
KeStackAttachProcess
PsLookupProcessByProcessId
RtlFreeUnicodeString
RtlStringFromGUID
ZwCreateEvent
ZwOpenEvent
ExAllocatePool
KeQueryInterruptTime
ZwSetInformationFile
KeGetCurrentThread
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation

hal

KeGetCurrentIrql

Sections

.text
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pak0
Size: - Virtual size: 974B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.pak1
Size: - Virtual size: 388KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.pak2
Size: 421KB - Virtual size: 420KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 276KB - Virtual size: 275KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

078a8792ef12271b25cf4c62e1a56c59

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: - Virtual size: 12KB

.rdata Size: - Virtual size: 980B

.data Size: - Virtual size: 972B

INIT Size: - Virtual size: 1KB

.pak0 Size: - Virtual size: 974B

.pak1 Size: - Virtual size: 388KB

.pak2 Size: 421KB - Virtual size: 420KB

.reloc Size: 276KB - Virtual size: 275KB

.text
Size: - Virtual size: 12KB

.rdata
Size: - Virtual size: 980B

.data
Size: - Virtual size: 972B

INIT
Size: - Virtual size: 1KB

.pak0
Size: - Virtual size: 974B

.pak1
Size: - Virtual size: 388KB

.pak2
Size: 421KB - Virtual size: 420KB

.reloc
Size: 276KB - Virtual size: 275KB