17bfcd800184d48b67163a4f4f962597_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

17bfcd800184d48b67163a4f4f962597_JaffaCakes118
Size

64KB
MD5

17bfcd800184d48b67163a4f4f962597
SHA1

5cb31ac32dafd4b6c0692a02b016187c1f40e847
SHA256

a48c5fc91f5aa3331f0053c16181266df33b141ca2d2c6437a78ba88767289f0
SHA512

c5efe455fc29905a934c5bd51b9cbef169d2798e77061d90e2b164370a5a523b00bd073bf559f02f8586b5e29d903a1df20af64f0c09a0b5ab0f2f8538bfd9a2
SSDEEP

1536:v5rAAulB8QQYJs6XVsUrSQm/wReuobzaUFQxC:v5rB0Bg0amu/wkug2UFQs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17bfcd800184d48b67163a4f4f962597_JaffaCakes118

Files

17bfcd800184d48b67163a4f4f962597_JaffaCakes118
.dll windows:5 windows x86 arch:x86

eaab8ff5701832d4caa20a82ad753976

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

T:\nxJQweT\gktLNcOk\Cqyfqcxtmzd\othzqLWkvpX\iAumQnpjaH.pdb

Imports

ntoskrnl.exe

RtlInitializeGenericTable
ZwFlushKey
KeSetTimer
RtlCreateSecurityDescriptor
PsImpersonateClient
MmUnlockPages
KeSetEvent
IoSetDeviceToVerify
RtlClearBits
SeDeassignSecurity
IoGetDeviceInterfaces
MmAddVerifierThunks
IoReportResourceForDetection
SeTokenIsAdmin
ZwQueryVolumeInformationFile
ProbeForWrite
ZwEnumerateKey
IoDeviceObjectType
MmMapLockedPages
KeSetSystemAffinityThread
IoGetDeviceObjectPointer
PsTerminateSystemThread
IoRaiseHardError
IoGetStackLimits
ZwOpenSection
KeGetCurrentThread
RtlAreBitsClear
IoIsWdmVersionAvailable
ExFreePool
PsGetCurrentProcessId
RtlCompareMemory
FsRtlGetNextFileLock
RtlFindNextForwardRunClear
ZwOpenSymbolicLinkObject
MmHighestUserAddress
IoGetInitialStack
MmFreeMappingAddress
KeInitializeSemaphore
PsReturnPoolQuota
ObInsertObject
RtlValidSecurityDescriptor
ZwQueryValueKey
MmAllocateMappingAddress
CcSetBcbOwnerPointer
RtlInt64ToUnicodeString
CcMdlRead
PsRevertToSelf
CcCopyRead
ExGetExclusiveWaiterCount
ExNotifyCallback
CcUninitializeCacheMap
RtlWriteRegistryValue
CcFastCopyWrite
IoSetStartIoAttributes
IoQueryDeviceDescription
ExGetPreviousMode
CcGetFileObjectFromBcb
KeStackAttachProcess
IoGetDeviceProperty
IoSetPartitionInformation
IoAllocateController
IoSetTopLevelIrp
ExDeleteNPagedLookasideList
KeQuerySystemTime
ExAllocatePoolWithQuota
RtlUnicodeStringToAnsiString
RtlDeleteRegistryValue
RtlAddAccessAllowedAce
ObfDereferenceObject
IoAcquireCancelSpinLock
IoCheckEaBufferValidity
IoWriteErrorLogEntry
ZwNotifyChangeKey
KeRemoveEntryDeviceQueue
KeSetBasePriorityThread
IoFreeIrp
RtlCompareUnicodeString

Exports

Exports

?IsNotProvider@@YGPAKD<V
?IncrementObjectOld@@YGXDPA_N<V
?ValidateObjectOld@@YGFMI<V
?InsertDialog@@YGEPAEPAE<V
?CopyDeviceOld@@YGPAFPAEKPAE<V
?OnListEx@@YGPAXKE<V

Sections

.text
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vdat
Size: - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eaab8ff5701832d4caa20a82ad753976

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 41KB - Virtual size: 40KB

.data Size: 4KB - Virtual size: 4KB

.vdat Size: - Virtual size: 18KB

.reloc Size: 1024B - Virtual size: 880B

.text
Size: 41KB - Virtual size: 40KB

.data
Size: 4KB - Virtual size: 4KB

.vdat
Size: - Virtual size: 18KB

.reloc
Size: 1024B - Virtual size: 880B