3c412ebb1efac29092e35e176fc0a69a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3c412ebb1efac29092e35e176fc0a69a_JaffaCakes118
Size

73KB
MD5

3c412ebb1efac29092e35e176fc0a69a
SHA1

1de9dd71106967321aecb5167c5ac4f83ddd7c25
SHA256

dc159a4de33a4bbccbcc0d9058ab29f5a36b7a8e59837ba3bc2e74b52b795e60
SHA512

8c57d77cb68d255a794d26f2bf1e1c7febce01b3f21c710f7f3a8a1b4618d9802c0556e9936047acbc72cb51944cdef1da04ed7a69b7481bb76ceb32b5810b87
SSDEEP

1536:UYb3DlCU7U+fqgog54F+Z1pcN6TbY35UjcA4:UYb3JbCUqFQ1p5BQA4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3c412ebb1efac29092e35e176fc0a69a_JaffaCakes118

Files

3c412ebb1efac29092e35e176fc0a69a_JaffaCakes118
.dll windows:4 windows x86 arch:x86

8af2e17cd67f858bd8a16c4266fc2d9e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

KeSetBasePriorityThread
RtlGetNextRange
MmFreeNonCachedMemory
PsLookupThreadByThreadId
FsRtlInitializeLargeMcb
RtlGetSaclSecurityDescriptor
ExRegisterCallback
ZwOpenSymbolicLinkObject
NtNotifyChangeDirectoryFile
FsRtlCheckLockForReadAccess
FsRtlGetNextFileLock
RtlUpperString
KeSetTimeIncrement

hal

HalDisplayString
KfReleaseSpinLock
KfLowerIrql
HalRequestIpi
HalGetEnvironmentVariable
KeTryToAcquireQueuedSpinLock
IoFreeMapRegisters
HalSetRealTimeClock
ExReleaseFastMutex

Sections

.data
Size: - Virtual size: 88KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 690B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ