144517b88486ebeb25b95b9232401b3e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

144517b88486ebeb25b95b9232401b3e_JaffaCakes118
Size

65KB
MD5

144517b88486ebeb25b95b9232401b3e
SHA1

dcb9848818e95fee65ac200a3ccfd6704919cc73
SHA256

4b516913af53c107b938c42fde6720ed2924ae084099fd6bfbc213a442caf46e
SHA512

8a631e1a42eb176a65e6c0637b6efe8d650c5f304ca641ad306d80f091cbafed83e3ea3153c80634b7d5559ab34402343530ed7581e57f70db01e14b6878ba3c
SSDEEP

1536:hdmFFLIlTOp9ZlNjBUnWCKQV0/BcYTrZ7ammE5TWX028:hdmFBCOllfluwLrhambtCZ8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
144517b88486ebeb25b95b9232401b3e_JaffaCakes118

Files

144517b88486ebeb25b95b9232401b3e_JaffaCakes118
.dll windows:4 windows x86 arch:x86

bde20d818ca9518e9b11623ef4e89b42

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

hal

KeQueryPerformanceCounter

ntoskrnl.exe

KeTickCount
KeInitializeTimer
KeInitializeSpinLock
KeInitializeEvent
PsGetCurrentThreadId
PsGetCurrentProcessId
MmQuerySystemSize
PsGetVersion
KeQueryActiveProcessors
KeInitializeMutex
IoGetCurrentProcess
memcpy
memset
KeGetCurrentThread

Sections

.text
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128B - Virtual size: 14B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 512B - Virtual size: 450B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 896B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ