jaffacakes118__29a6f66f28a8c75280b10daf41dba3da

General

Target
jaffacakes118__29a6f66f28a8c75280b10daf41dba3da
Size 118KB
Sample260920-2zed3sfm2t
SHA256 4ecbadc525b9b1a8510f243c10e2021aa0fe876a7f1233c443726748aca7241c
MD5 29a6f66f28a8c75280b10daf41dba3da
SHA1 995c3719be6f6e0274c7ad9feed2d015ff311662
SHA512 1bc214af626449509aade6d0a204666d7de4127553d4adc7a65d9540a2e91f867085f9b978c17a1d8d037495d49578f67d22a08c4996e871a4c62bd36e84a7d0
SSDEEP 1536:h9wOYQFRAIns1VIP9OSwGNlohQJOkzblLtBSCAfQTdAH5XL2cKmyikkHPHfTljF:DzYWRAImIVOElpnlLIVZXKcK1IH
TLSH
T1FEC31206534118B4F1DA06B4476A45B036E6926A4A7BE32975C1ACDF94CECFC7E0BB0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118__29a6f66f28a8c75280b10daf41dba3da

File Explorer

jaffacakes118__29a6f66f28a8c75280b10daf41dba3da

.sys 118KB

jaffacakes118__29a6f66f28a8c75280b10daf41dba3da

IMPHASH d3ac47d5acb66133eb98042bbe0cf5d8
SHA256 4ecbadc525b9b1a8510f243c10e2021aa0fe876a7f1233c443726748aca7241c
MD5 29a6f66f28a8c75280b10daf41dba3da
SHA1 995c3719be6f6e0274c7ad9feed2d015ff311662
SHA512 1bc214af626449509aade6d0a204666d7de4127553d4adc7a65d9540a2e91f867085f9b978c17a1d8d037495d49578f67d22a08c4996e871a4c62bd36e84a7d0
SSDEEP 1536:h9wOYQFRAIns1VIP9OSwGNlohQJOkzblLtBSCAfQTdAH5XL2cKmyikkHPHfTljF:DzYWRAImIVOElpnlLIVZXKcK1IH
TLSH
T1FEC31206534118B4F1DA06B4476A45B036E6926A4A7BE32975C1ACDF94CECFC7E0BB0F
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

130560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntoskrnl.exe

MmMapLockedPagesSpecifyCache PsTerminateSystemThread RtlCompareMemory ZwClose ObfDereferenceObject KeWaitForSingleObject KeSetEvent KeDelayExecutionThread IofCompleteRequest ExAllocatePoolWithTag PsGetCurrentProcessId PsSetLoadImageNotifyRoutine KeInitializeEvent RtlImageNtHeader ExAllocatePool atoi strlen wcscmp IoGetLowerDeviceObject IoCreateFile PsGetVersion ZwQueryValueKey ZwOpenKey RtlInitUnicodeString wcslen ExInitializeResourceLite ObReferenceObjectByHandle PsCreateSystemThread RtlRandom KeTickCount KeQuerySystemTime ZwQuerySymbolicLinkObject ZwOpenSymbolicLinkObject _stricmp ZwQueryInformationFile ZwMapViewOfSection ZwCreateSection ZwCreateFile IofCallDriver IoBuildDeviceIoControlRequest ZwFsControlFile ZwQueryVolumeInformationFile _allmul _alldiv ZwSetInformationFile ZwReadFile IoGetRelatedDeviceObject IoFreeIrp _except_handler3 RtlImageDirectoryEntryToData memcpy IoGetCurrentProcess KeLeaveCriticalRegion ExReleaseResourceLite ExAcquireResourceExclusiveLite KeEnterCriticalRegion MmHighestUserAddress strcpy ZwQuerySystemInformation ZwQueryInformationProcess RtlEqualUnicodeString strcmp KeUnstackDetachProcess KeStackAttachProcess PsLookupProcessByProcessId ZwQueryObject wcscat _alloca_probe KeRevertToUserAffinityThread KeSetSystemAffinityThread KeQueryActiveProcessors IoAllocateIrp KeInsertQueueApc KeInitializeApc ZwAllocateVirtualMemory PsGetProcessImageFileName _wcsupr ObMakeTemporaryObject ObfReferenceObject strcat strncpy strstr IoFileObjectType strchr MmIsAddressValid PsGetCurrentThreadId FsRtlIsNameInExpression PsLookupThreadByThreadId memset KeGetCurrentThread ExFreePoolWithTag

hal

KfReleaseSpinLock KfAcquireSpinLock

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118__29a6f66f28a8c75280b10daf41dba3da

ntoskrnl.exe

hal

generic