078e118a6e71e8b93ab131fb186e148a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

078e118a6e71e8b93ab131fb186e148a_JaffaCakes118
Size

70KB
MD5

078e118a6e71e8b93ab131fb186e148a
SHA1

6eddbd767d64e009d257f57364ff2042fc7f05d7
SHA256

0223a3d5afe1751538e786393a47a5113756ba131de23c7df5c8ec0c3d12822f
SHA512

2bd9c4b9be5b1ba329bd920aeb4248ea3bfcdbdacdeceb0bebd15d31ed363b73c076acae53d6d967ecacc9fe9dfe206cb0032a1e7f155daa37ac5eb6b3d69078
SSDEEP

1536:sGYfa0tQFMq588xdo4FkR+hYSvHKI9T38V8vxTpHbMh:s7f5GFr0OkeFvHKIZ3BT1w

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
078e118a6e71e8b93ab131fb186e148a_JaffaCakes118

Files

078e118a6e71e8b93ab131fb186e148a_JaffaCakes118
.dll windows:4 windows x86 arch:x86

75664f39bdf9afb570e6abf22c318e47

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

IoAdapterObjectType
RtlCustomCPToUnicodeN
SeLockSubjectContext
RtlRandom
FsRtlIsNameInExpression
atol
IoCheckQuotaBufferValidity
FsRtlCheckLockForWriteAccess
RtlEnumerateGenericTable

hal

KeRaiseIrqlToSynchLevel
KfAcquireSpinLock
HalAllProcessorsStarted
KeTryToAcquireQueuedSpinLock
HalSetBusData
KeFlushWriteBuffer
IoReadPartitionTable
KeAcquireSpinLock
READ_PORT_UCHAR

Sections

.data
Size: - Virtual size: 84KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 563B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ