429c78800b5845ab1b6f49aebc27155f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

429c78800b5845ab1b6f49aebc27155f_JaffaCakes118
Size

25KB
MD5

429c78800b5845ab1b6f49aebc27155f
SHA1

e47a1e6d97834d9db7c5e2d450d93c18ee7fa352
SHA256

f5507605cc2abcbd7fe50717b5847ee00b130d8a408ad0ccb03a6eb894a0308c
SHA512

404fa5ed25ead80424cf2bdc6fe21cedd021191752d2d478279b382291a45ade92dbee7dee0b24f8703d48312a0d71081179190d940866fb0efce5757eb420e7
SSDEEP

384:vqMDjZm8RhLHUPDnraaHXoyJDccbkqbp0G0c05NAsUOLLvYx0tL:vlJHGDzkqlhH2KshLR

Score

1^/10

Malware Config

Signatures

Files

429c78800b5845ab1b6f49aebc27155f_JaffaCakes118
.sys windows:6 windows x86 arch:x86

bfca9a55c532031d5d77dbaf1f2ceb95

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:5e:44:d3:ba:f9:a5:5b:24:89:cf:3a:80:23:bb:f4
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

15/09/2010, 00:00

Not After

15/09/2011, 23:59

Subject

CN=北京易通无线信息技术有限公司,OU=WoSign Class 3 Code Signing,O=北京易通无线信息技术有限公司,L=东城区,ST=北京市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

d2:86:84:f9:db:81:3f:b9:6b:3b:01:e2:68:69:f9:89:23:08:ec:e2
Signer

Actual PE Digest

d2:86:84:f9:db:81:3f:b9:6b:3b:01:e2:68:69:f9:89:23:08:ec:e2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\passthru\siglow\driver\objchk_wxp_x86\i386\vmware.pdb

Imports

ntoskrnl.exe

KeTickCount
IofCompleteRequest
RtlInitUnicodeString
memset
memcpy
MmMapLockedPagesSpecifyCache
strstr
DbgPrint
RtlAssert

hal

KfReleaseSpinLock
KfAcquireSpinLock

ndis.sys

NdisReEnumerateProtocolBindings
NdisIMNotifyPnPEvent
NdisGetReceivedPacket
NdisPacketPoolUsage
NdisDprFreePacket
NdisIMCancelInitializeDeviceInstance
NdisIMDeInitializeDeviceInstance
NdisQueryPendingIOCount
NdisDprAllocatePacket
NdisCancelSendPackets
NdisSetEvent
NdisMSetAttributesEx
NdisIMGetDeviceContext
NdisFreePacket
NdisIMCopySendCompletePerPacketInfo
NdisIMCopySendPerPacketInfo
NdisAllocatePacket
NdisIMGetCurrentPacketStack
NdisFreeMemory
NdisAllocateMemory
NdisRequest
NdisMIndicateStatusComplete
NdisMIndicateStatus
NdisReturnPackets
NdisGetPoolFromPacket
NdisWaitEvent
NdisCloseAdapter
NdisResetEvent
NdisFreePacketPool
NdisTerminateWrapper
NdisIMAssociateMiniport
NdisIMDeregisterLayeredMiniport
NdisRegisterProtocol
NdisMRegisterUnloadHandler
NdisIMRegisterLayeredMiniport
NdisInitializeWrapper
NdisMRegisterDevice
NdisMSleep
NdisMDeregisterDevice
NdisDeregisterProtocol
NdisCloseConfiguration
NdisIMInitializeDeviceInstanceEx
NdisOpenAdapter
NdisAllocatePacketPoolEx
NdisInitializeEvent
NdisAllocateMemoryWithTag
NdisReadConfiguration
NdisOpenProtocolConfiguration

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384B - Virtual size: 365B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bfca9a55c532031d5d77dbaf1f2ceb95

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

21:5e:44:d3:ba:f9:a5:5b:24:89:cf:3a:80:23:bb:f4Certificate

Extended Key Usages

Key Usages

d2:86:84:f9:db:81:3f:b9:6b:3b:01:e2:68:69:f9:89:23:08:ec:e2Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

ndis.sys

Sections

.text Size: 13KB - Virtual size: 13KB

.rdata Size: 384B - Virtual size: 365B

.data Size: 2KB - Virtual size: 2KB

INIT Size: 2KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

21:5e:44:d3:ba:f9:a5:5b:24:89:cf:3a:80:23:bb:f4
Certificate

d2:86:84:f9:db:81:3f:b9:6b:3b:01:e2:68:69:f9:89:23:08:ec:e2
Signer

.text
Size: 13KB - Virtual size: 13KB

.rdata
Size: 384B - Virtual size: 365B

.data
Size: 2KB - Virtual size: 2KB

INIT
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB