1783c0727a76be402c3da73c15ed0910_JaffaCakes118

General

Target

1783c0727a76be402c3da73c15ed0910_JaffaCakes118
Size

31KB
MD5

1783c0727a76be402c3da73c15ed0910
SHA1

39cc839b1fb97f6e3911ea2aa308b1d5dabba299
SHA256

6531f8921b49146f1b9a718da5d5231d9c23f64d6f5e68a4d2e2caab4770c73e
SHA512

1d249906397e489bd0643502202c7128034ce11494afae84aef62aba6c9faec8eddb786859f04ef5af035ae5a13cc9a87d8be8dc5ce77725489d83acb1dc5219
SSDEEP

768:liE7wiTxfiB2CzsMkxOEARrtYoDK0MDibA8iX9:QE7tTiqOE6hYEKYbU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1783c0727a76be402c3da73c15ed0910_JaffaCakes118

Files

1783c0727a76be402c3da73c15ed0910_JaffaCakes118
.dll windows:4 windows x86 arch:x86

87fd41a5d2ceb5b996484ada92d631d0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

MmCreateSection
tolower
RtlImageNtHeader
MmCanFileBeTruncated
NlsOemLeadByteInfo
IoReportResourceUsage
_local_unwind2
KeSetKernelStackSwapEnable
CcGetFileObjectFromSectionPtrs
ExInterlockedPushEntrySList
DbgBreakPointWithStatus
ExEventObjectType
PsThreadType
ZwPulseEvent
KeProfileInterrupt
ExFreePool
PsSetCreateProcessNotifyRoutine
RtlSecondsSince1980ToTime
RtlxUnicodeStringToAnsiSize
PsJobType
KefReleaseSpinLockFromDpcLevel
KeI386GetLid
MmBuildMdlForNonPagedPool
FsRtlDissectName
KeInitializeEvent

hal

HalStopProfileInterrupt
HalFlushCommonBuffer
HalGetBusDataByOffset
KeTryToAcquireQueuedSpinLock
HalTranslateBusAddress
IoSetPartitionInformation
HalSystemVectorDispatchEntry
HalAdjustResourceList
HalStartProfileInterrupt
KeAcquireQueuedSpinLock
WRITE_PORT_ULONG
HalStartNextProcessor
HalGetEnvironmentVariable
KeFlushWriteBuffer
KeLowerIrql
HalSetProfileInterval
HalSetTimeIncrement
HalAllProcessorsStarted
HalCalibratePerformanceCounter
KeRaiseIrqlToDpcLevel
HalInitializeProcessor
KfLowerIrql

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 14B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

87fd41a5d2ceb5b996484ada92d631d0

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 3KB - Virtual size: 3KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 24KB - Virtual size: 55KB

.rsrc Size: 1024B - Virtual size: 728B

.reloc Size: 512B - Virtual size: 14B

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 24KB - Virtual size: 55KB

.rsrc
Size: 1024B - Virtual size: 728B

.reloc
Size: 512B - Virtual size: 14B