00881dc2cd0d3268f52e006ef13ef9c1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

00881dc2cd0d3268f52e006ef13ef9c1_JaffaCakes118
Size

2.6MB
MD5

00881dc2cd0d3268f52e006ef13ef9c1
SHA1

42865799cd7fbc3f3cf66cb4f051e11efe9a0b22
SHA256

3acccca475d8faf672e57b3ac9add21c01e6862ec1aa4cf19126a1d3a2de4abd
SHA512

d7f2ad56a2e2c788fb6c45c153354ba3d3173b50abb6c890450aa9b3ecf563a78b68ea5a2a6b5265e685aee7b62cb7161c97065d331b31d6572d631846c377b2
SSDEEP

49152:W7ivkJT3ZhLn0PqqR6Uj8tIC5TAZuX6LyadFwJGRXnP:Wge+6R3e9P

Score

1^/10

Malware Config

Signatures

Files

00881dc2cd0d3268f52e006ef13ef9c1_JaffaCakes118
.sys windows:10 windows x64 arch:x64

71eeb1afe96b7f59a1f04c8c45eee10d

Code Sign

5d:11:78:4f:b8:17:65:02:3f:89:a4:f4:24:3f:e1:a9
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

17/01/2014, 00:00

Not After

17/01/2016, 23:59

Subject

CN=Binzhoushi Yongyu Feed Co.\,LTd.,O=Binzhoushi Yongyu Feed Co.\,LTd.,L=Binzhou,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:31

Not After

22/02/2021, 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

df:6c:51:78:9e:36:fc:04:c0:13:79:9d:0b:cf:0a:ec:87:0e:bf:68
Signer

Actual PE Digest

df:6c:51:78:9e:36:fc:04:c0:13:79:9d:0b:cf:0a:ec:87:0e:bf:68

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Administrator\Desktop\Crystal\x64\Release\Crystal.pdb

Imports

netio.sys

WskCaptureProviderNPI

ntoskrnl.exe

ExAllocatePool
ExAllocatePool
NtQuerySystemInformation
ExFreePoolWithTag
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
KeQueryActiveProcessors
KeSetSystemAffinityThread
KeRevertToUserAffinityThread
DbgPrint

hal

KeQueryPerformanceCounter

Sections

.text
Size: - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.HJKmnq0
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.HJKmnq1
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.HJKmnq2
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

71eeb1afe96b7f59a1f04c8c45eee10d

Code Sign

5d:11:78:4f:b8:17:65:02:3f:89:a4:f4:24:3f:e1:a9Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

61:1f:b0:a4:00:00:00:00:00:1dCertificate

Key Usages

df:6c:51:78:9e:36:fc:04:c0:13:79:9d:0b:cf:0a:ec:87:0e:bf:68Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

netio.sys

ntoskrnl.exe

hal

Sections

.text Size: - Virtual size: 15KB

.rdata Size: - Virtual size: 2KB

.data Size: - Virtual size: 472B

.pdata Size: - Virtual size: 840B

.gfids Size: - Virtual size: 4B

INIT Size: - Virtual size: 1KB

.HJKmnq0 Size: - Virtual size: 1.3MB

.HJKmnq1 Size: 512B - Virtual size: 8B

.HJKmnq2 Size: 2.6MB - Virtual size: 2.6MB

.reloc Size: 512B - Virtual size: 208B

5d:11:78:4f:b8:17:65:02:3f:89:a4:f4:24:3f:e1:a9
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

df:6c:51:78:9e:36:fc:04:c0:13:79:9d:0b:cf:0a:ec:87:0e:bf:68
Signer

.text
Size: - Virtual size: 15KB

.rdata
Size: - Virtual size: 2KB

.data
Size: - Virtual size: 472B

.pdata
Size: - Virtual size: 840B

.gfids
Size: - Virtual size: 4B

INIT
Size: - Virtual size: 1KB

.HJKmnq0
Size: - Virtual size: 1.3MB

.HJKmnq1
Size: 512B - Virtual size: 8B

.HJKmnq2
Size: 2.6MB - Virtual size: 2.6MB

.reloc
Size: 512B - Virtual size: 208B