15bfde2d2abb0d6217c38a1e8a5c59fe_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

15bfde2d2abb0d6217c38a1e8a5c59fe_JaffaCakes118
Size

133KB
MD5

15bfde2d2abb0d6217c38a1e8a5c59fe
SHA1

8902b1e740f1f22a4d80c8818627a5fef94c88a2
SHA256

699fde2cda9b6c8d0f40677bab12949c65c29062e7784fd495092ab5c7de9a9c
SHA512

79285ede2fb49a6fa4b27bc78218d5b32afe19819b4894598081c4a9f189c0e2d3665ae2a3af2e02316c05920cedd18b63364db650a8c0416fe5298007d16aee
SSDEEP

3072:zNGfulBooRd3ltwMqWzoazeNWt2L9ZmpdoNbVC:kYRdltlpz3qMULmpdeC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
15bfde2d2abb0d6217c38a1e8a5c59fe_JaffaCakes118

Files

15bfde2d2abb0d6217c38a1e8a5c59fe_JaffaCakes118
.dll windows:1 windows x86 arch:x86

ce90dad4a16db3406f390be7698e051b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

ObReferenceObjectByHandle
FsRtlNumberOfRunsInLargeMcb
RtlAnsiCharToUnicodeChar
wcsncpy
KeBugCheckEx
strncpy
RtlFreeOemString
MmMapLockedPagesSpecifyCache
SeSetAccessStateGenericMapping
IoWMIQuerySingleInstance
IoReleaseRemoveLockAndWaitEx
ObfReferenceObject
ExFreePoolWithTag
ExAllocatePoolWithTag
NtAllocateVirtualMemory
KeTickCount
strstr
DbgBreakPoint
IoGetCurrentProcess
strncmp
MmSizeOfMdl
ZwQuerySystemInformation
KeQueryTimeIncrement
_except_handler3
DbgPrint

Sections

.data
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 640B - Virtual size: 635B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 800B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 192B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE