jaffacakes118_Trojan-Dropper[.]Win32[.]Agent[.]ixnm[.]f4afe5bd8543167f9873a49e3409edf6

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Dropper.Win32.Agent.ixnm.f4afe5bd8543167f9873a49e3409edf6
Size 4KB
Sample261006-tfc3xafe29
SHA256 158d622e937dfb42c2dcf53a7fe7969181749b393fa3ecb21b34fdb41069790b
MD5 f4afe5bd8543167f9873a49e3409edf6
SHA1 29d21cc760631fc47245fe057bded31d9f74fb0c
SHA512 dbd394bee699e585f7ba70aa12d5d83a872af9ace82eeb2b9a3929762d1a4d4537c6590fe1ebb0bfd7f6676f8560b6aee728db6757ec44cd1d05354b3d699461
SSDEEP 48:qi0tokwrGODzM6+wakRm2j+sUGxXlPyEqOU19JRWqKzw74Tg9RrfDLPOuX/MvNWK:90ew6C1kIIV1t+/1wsT1bD8WK
TLSH
T1A5A1B44013D9A7F4F8FD293419F3429399B3BC52D9B7DB0E1994608E3D38A016868B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Dropper.Win32.Agent.ixnm.f4afe5bd8543167f9873a49e3409edf6

File Explorer

jaffacakes118_Trojan-Dropper.Win32.Agent.ixnm.f4afe5bd8543167f9873a49e3409edf6

.sys 4KB

jaffacakes118_Trojan-Dropper.Win32.Agent.ixnm.f4afe5bd8543167f9873a49e3409edf6

IMPHASH 2be5d4c7d34f01780ed31a60890baee6
SHA256 158d622e937dfb42c2dcf53a7fe7969181749b393fa3ecb21b34fdb41069790b
MD5 f4afe5bd8543167f9873a49e3409edf6
SHA1 29d21cc760631fc47245fe057bded31d9f74fb0c
SHA512 dbd394bee699e585f7ba70aa12d5d83a872af9ace82eeb2b9a3929762d1a4d4537c6590fe1ebb0bfd7f6676f8560b6aee728db6757ec44cd1d05354b3d699461
SSDEEP 48:qi0tokwrGODzM6+wakRm2j+sUGxXlPyEqOU19JRWqKzw74Tg9RrfDLPOuX/MvNWK:90ew6C1kIIV1t+/1wsT1bD8WK
TLSH
T1A5A1B44013D9A7F4F8FD293419F3429399B3BC52D9B7DB0E1994608E3D38A016868B77
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2175

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\KPDrv\objfre\i386\KPDrv.pdb

Name

.text

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

256B

Virtual Size

163B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

640B

Virtual Size

566B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

896B

Virtual Size

880B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

256B

Virtual Size

154B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.ddss

Size

128B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

jaffacakes118_Trojan-Dropper.Win32.Agent.ixnm.f4afe5bd8543167f9873a49e3409edf6

ntoskrnl.exe

hal

generic