10f51d864e7bf2ffbcb8ec999097f354_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

10f51d864e7bf2ffbcb8ec999097f354_JaffaCakes118
Size

78KB
MD5

10f51d864e7bf2ffbcb8ec999097f354
SHA1

935d3d2c3792f8d0729081028255dafcecbabd6b
SHA256

588d2929c4fdff882fd4e04dc01ce54b805732a3ebe2ce72d070158a4f9acec9
SHA512

923846a62b601c766930a4b149250bdf75b5305e92a1604c6820f52bf1ec320ea33e0dcf39b075664fa123c9359c6d8c53e7c322d9be9d388d249d8246150cb4
SSDEEP

1536:gA13OxEeNTHP817kHiJ/CbmdBUzgopSwQNWA1f:hxOxEeNTvK6U/Cbix1eAd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
10f51d864e7bf2ffbcb8ec999097f354_JaffaCakes118

Files

10f51d864e7bf2ffbcb8ec999097f354_JaffaCakes118
.dll windows:4 windows x86 arch:x86

5d9adba352d13ab1fc29231aee78128e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

IoMakeAssociatedIrp
IoIsValidNameGraftingBuffer
RtlImageDirectoryEntryToData
FsRtlInitializeTunnelCache
memchr
RtlUpcaseUnicodeToCustomCPN
CcUnpinData
MmUserProbeAddress
CcUnpinRepinnedBcb
MmIsThisAnNtAsSystem
ZwQueryDirectoryObject
IoReportTargetDeviceChange

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ