17753088fd5ff94634274bb5ac318d03_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

17753088fd5ff94634274bb5ac318d03_JaffaCakes118
Size

60KB
MD5

17753088fd5ff94634274bb5ac318d03
SHA1

0133687e5fc69eb80132b385827226de4580ca10
SHA256

dd09b9a258a267c4a1eefb3f72d0946c08c6a366cce9047641e6f9f0a929305d
SHA512

9a1ddc902151c9d5a9140c2932dd91ba878333207cd8d10c1346117836946f4bb484e46c9c330b309bcb7f0074ac95df982579ba75f5229b3598d8fcc535ddfa
SSDEEP

768:19htYuxxMz4m/0+m45dC66lsgrgipeaddlrTpEMaqZFI6rF2zRb1sueIxz9IsSnH:FVSzqiAls+gi0wvphy8F2zRb1suL9cH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17753088fd5ff94634274bb5ac318d03_JaffaCakes118

Files

17753088fd5ff94634274bb5ac318d03_JaffaCakes118
.dll windows:4 windows x86 arch:x86

65bb2bf013e2a1448c9d69194be70193

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

hal

KeQueryPerformanceCounter

ntoskrnl.exe

KeGetCurrentThread
KeInitializeTimer
MmQuerySystemSize
memcpy
memset
PsGetCurrentProcessId
IoGetCurrentProcess
KeTickCount
KeInitializeMutex
PsGetCurrentThreadId
KeQueryActiveProcessors
KeInitializeSpinLock
PsGetVersion

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 640B - Virtual size: 633B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128B - Virtual size: 14B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 512B - Virtual size: 426B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 896B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ