09bc7779e8049fd62e2564843efc7ec5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

09bc7779e8049fd62e2564843efc7ec5_JaffaCakes118
Size

134KB
MD5

09bc7779e8049fd62e2564843efc7ec5
SHA1

1b5ce4769b0d1ba335ea0377454b26a369ca5022
SHA256

de0d8ddaecd7bb351cb0b00c8ae2618b29a9bf8de14356e9d19cb22cee4b6ddc
SHA512

7d911e928ae7a6b8114a8eda51f3fd5b29b21fca3c39ee06c1c46c5bfa29234c87cfb1c9bfc2d22f28df2600bf3126334cb8dbf7a2674b6de9108975c3ccf510
SSDEEP

3072:tRARXCGjqgROQ0KHedxaS/5d7VU40ruRjrlhLkvN/2iw2w:tRARXqFIHedxaQ5d7L4uR3YvN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09bc7779e8049fd62e2564843efc7ec5_JaffaCakes118

Files

09bc7779e8049fd62e2564843efc7ec5_JaffaCakes118
.dll windows:1 windows x86 arch:x86

4f1c47de62fc0e7a1ef477b715f39f6a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

IoPageRead
MmMapLockedPagesSpecifyCache
ExFreePoolWithTag
RtlWriteRegistryValue
ZwQuerySystemInformation
DbgPrint
PsEstablishWin32Callouts
KeTickCount
RtlAnsiCharToUnicodeChar
IoGetCurrentProcess
ObfReferenceObject
PsGetThreadProcessId
RtlUnicodeStringToCountedOemString
KeBugCheckEx
IoCreateFileSpecifyDeviceObjectHint
FsRtlInitializeFileLock
strstr
_except_handler3
wcsncpy
ExAllocatePoolWithTag
ObReferenceObjectByHandle
strncmp
strncpy
KeQueryTimeIncrement
RtlTimeToElapsedTimeFields

Sections

.data
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 640B - Virtual size: 636B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 832B - Virtual size: 814B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 192B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE