fc889ff25bf0c7f0dfa7369a3550cdf4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fc889ff25bf0c7f0dfa7369a3550cdf4_JaffaCakes118
Size

5KB
MD5

fc889ff25bf0c7f0dfa7369a3550cdf4
SHA1

2d8d169d63549df1ea56e04f0c68a97b0a573433
SHA256

d707abd1f47c1fa94bbb2932c7b033ec58fd6690e0f90219c972ed9e3960c981
SHA512

32dbf2c5401b623f2e7e1fcf4ef212fe096bf8af23211bde7b272b4a4d3fd4fcf711c091486d5d2938d8b3cde91a45c52fdb809f9e2567d8ed42f0f5cfadc6ca
SSDEEP

96:6dsfRFFPhc01nbnoMjYwl2aqaCyQhfABWwpcLajkSq:He0RD0wE/hfqx3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fc889ff25bf0c7f0dfa7369a3550cdf4_JaffaCakes118

Files

fc889ff25bf0c7f0dfa7369a3550cdf4_JaffaCakes118
.dll windows:5 windows x86 arch:x86

90ca042ace32bf194a0dda8e2ec06446

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\ADPlus2010\ADPlus5.0\Setup2.0\miniDriver\Check\MiniDriver.pdb

Imports

ntoskrnl.exe

ZwClose
PsCreateSystemThread
RtlDeleteRegistryValue
RtlWriteRegistryValue
RtlCreateRegistryKey
ZwWriteFile
ExFreePoolWithTag
ZwReadFile
ExAllocatePoolWithTag
ZwQueryInformationFile
ZwCreateFile
RtlRandom
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlGetVersion
PsTerminateSystemThread
RtlFreeUnicodeString
ZwLoadDriver
RtlAppendUnicodeStringToString
RtlQueryRegistryValues
KeDelayExecutionThread

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 213B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 128B - Virtual size: 50B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 640B - Virtual size: 596B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 138B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ