fd0bd58e63badfeb7ce538a4de4dac4d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fd0bd58e63badfeb7ce538a4de4dac4d_JaffaCakes118
Size

65KB
MD5

fd0bd58e63badfeb7ce538a4de4dac4d
SHA1

dbb8d2d9e1e92120cc115beb556afaebcbf4dc0f
SHA256

cfe2810e0920c65f97228b1eec499790f3d0cc6e2209c216674bde666bfd1af6
SHA512

65f0ff884a8de6e9baedd2fcebba8fdef0031ca8615ef73ccaadd04ed3fa5f201c58ba6528acbdc4315652e03146ceb043c045e60f31fcffbc2115e838a76f31
SSDEEP

1536:VdmFFLIlTOp9ZlNjBUnWCKQV0/BcYTrZ7ammE5TWX028:VdmFBCOllfluwLrhambtCZ8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fd0bd58e63badfeb7ce538a4de4dac4d_JaffaCakes118

Files

fd0bd58e63badfeb7ce538a4de4dac4d_JaffaCakes118
.dll windows:4 windows x86 arch:x86

bde20d818ca9518e9b11623ef4e89b42

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

hal

KeQueryPerformanceCounter

ntoskrnl.exe

KeTickCount
KeInitializeTimer
KeInitializeSpinLock
KeInitializeEvent
PsGetCurrentThreadId
PsGetCurrentProcessId
MmQuerySystemSize
PsGetVersion
KeQueryActiveProcessors
KeInitializeMutex
IoGetCurrentProcess
memcpy
memset
KeGetCurrentThread

Sections

.text
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128B - Virtual size: 14B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 512B - Virtual size: 450B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 896B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ