jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]49c95baad285d6f21799e60f685cc5a8

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.49c95baad285d6f21799e60f685cc5a8
Size 70KB
Sample261014-c381esxvbv
SHA256 28bd4f4422ae9d10b590ec1637fb80654c8a7bab2f2df0d875ca9bdbe79d6dd5
MD5 49c95baad285d6f21799e60f685cc5a8
SHA1 7282aec2ba390b644dcdd5b7c3ce204ec93961e9
SHA512 f6a53e7ad8a74acb35f54262bf4529fa3902a22a87191fbcb4200cf3d1021714dbc7620d31247195c6d8dea5349e23bcc321999e75cc20cb9c6de6d9f88114b1
SSDEEP 1536:o3eIPR0EftJoeuskjQspTKAQRLSNj8bLMWECXoNtQ/:odOEf5VkssxKAQR2Nj8bLtTUtQ/
TLSH
T18D637CA13402ED32C3B2347C4A7BF234D25A1D69CFF5668AD40135F42E796A0AE7D2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.49c95baad285d6f21799e60f685cc5a8

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.49c95baad285d6f21799e60f685cc5a8

.sys 70KB

jaffacakes118_HEUR.Trojan.Win32.Generic.49c95baad285d6f21799e60f685cc5a8

IMPHASH e4d5018239adc4a7d57290e9c40cebd2
SHA256 28bd4f4422ae9d10b590ec1637fb80654c8a7bab2f2df0d875ca9bdbe79d6dd5
MD5 49c95baad285d6f21799e60f685cc5a8
SHA1 7282aec2ba390b644dcdd5b7c3ce204ec93961e9
SHA512 f6a53e7ad8a74acb35f54262bf4529fa3902a22a87191fbcb4200cf3d1021714dbc7620d31247195c6d8dea5349e23bcc321999e75cc20cb9c6de6d9f88114b1
SSDEEP 1536:o3eIPR0EftJoeuskjQspTKAQRLSNj8bLMWECXoNtQ/:odOEf5VkssxKAQR2Nj8bLtTUtQ/
TLSH
T18D637CA13402ED32C3B2347C4A7BF234D25A1D69CFF5668AD40135F42E796A0AE7D2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

45887

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntoskrnl.exe

ExFreePoolWithTag wcschr _stricmp strncpy wcsncpy strlen RtlCompareMemory RtlAnsiStringToUnicodeString RtlInitAnsiString RtlInitUnicodeString memset KeInitializeMutex KeWaitForSingleObject KeReleaseMutex ZwClose ObReferenceObjectByHandle PsCreateSystemThread KeQuerySystemTime _aulldiv RtlUnicodeStringToInteger RtlTimeToTimeFields _allmul KeUnstackDetachProcess KeStackAttachProcess IofCompleteRequest PoCallDriver PoStartNextPowerIrp IoDeleteDevice IoAttachDeviceToDeviceStack IoCreateDevice ObfReferenceObject IoGetRelatedDeviceObject IoCreateFile IoAttachDevice IofCallDriver IoGetCurrentProcess _purecall RtlWriteRegistryValue RtlCreateRegistryKey swprintf ExAllocatePoolWithTag RtlFreeUnicodeString MmGetSystemRoutineAddress strcmp MmUnlockPages IoFreeMdl MmProbeAndLockPages IoAllocateMdl RtlCopyUnicodeString DbgPrint KeNumberProcessors RtlFreeAnsiString RtlUnicodeStringToAnsiString RtlQueryRegistryValues PsGetVersion IoRegisterShutdownNotification KeSetEvent KeInitializeEvent KeGetCurrentThread ObfDereferenceObject RtlCompareUnicodeString ObQueryNameString ObReferenceObjectByName IoDriverObjectType IoFreeIrp ObInsertObject IoAllocateIrp SeSetAccessStateGenericMapping RtlMapGenericMask SeCreateAccessState ObCreateObject IoFileObjectType IoBuildDeviceIoControlRequest IoCancelIrp KeWaitForMultipleObjects KeResetEvent KeClearEvent IoCreateSynchronizationEvent KeSetPriorityThread KeBugCheckEx MmIsAddressValid strchr ZwWriteFile ZwReadFile RtlDeleteRegistryValue memcpy RtlUnwind

hal

KfRaiseIrql KfAcquireSpinLock KfReleaseSpinLock KeGetCurrentIrql KfLowerIrql

Name

.text

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

pagecode

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.49c95baad285d6f21799e60f685cc5a8

ntoskrnl.exe

hal

generic