jaffacakes118_Virus[.]Win32[.]TDSS[.]b[.]d93d059e1418ff3f3f87a657e451ba2f

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Virus.Win32.TDSS.b.d93d059e1418ff3f3f87a657e451ba2f
Size 39KB
Sample261014-p4qlpadt4z
SHA256 d5e64e0e92bd4e9cab273081531d4f7669b5573965f41a1ebe92a053823a27d4
MD5 d93d059e1418ff3f3f87a657e451ba2f
SHA1 c5448af210ee55f970bb1851e85b4e61a3499e93
SHA512 86f8c0739758ca386e1ea53d01b78b46610c9fd5693ff636a5fad8da36e3dbc0ff8419dc49cf8ac9c790845768623238687e512ed5f911bacf3a5046cb7b50c5
SSDEEP 768:CgBVkFGidt7PJdUzJtQbJj9e7SGyXiJ2/+ZAWA4J:CgBuFTFdU0Jj94S0gMAW5J
TLSH
T194038D1099D66539ECE32BF4086E373855BFEAA02339C5CB021406E99C69AE17D7437F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Virus.Win32.TDSS.b.d93d059e1418ff3f3f87a657e451ba2f

File Explorer

jaffacakes118_Virus.Win32.TDSS.b.d93d059e1418ff3f3f87a657e451ba2f

.sys 39KB

jaffacakes118_Virus.Win32.TDSS.b.d93d059e1418ff3f3f87a657e451ba2f

IMPHASH 9536a3dd4e2a149706d2e3221ed44b1b
SHA256 d5e64e0e92bd4e9cab273081531d4f7669b5573965f41a1ebe92a053823a27d4
MD5 d93d059e1418ff3f3f87a657e451ba2f
SHA1 c5448af210ee55f970bb1851e85b4e61a3499e93
SHA512 86f8c0739758ca386e1ea53d01b78b46610c9fd5693ff636a5fad8da36e3dbc0ff8419dc49cf8ac9c790845768623238687e512ed5f911bacf3a5046cb7b50c5
SSDEEP 768:CgBVkFGidt7PJdUzJtQbJj9e7SGyXiJ2/+ZAWA4J:CgBuFTFdU0Jj94S0gMAW5J
TLSH
T194038D1099D66539ECE32BF4086E373855BFEAA02339C5CB021406E99C69AE17D7437F
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25748

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

intelppm.pdb

ntoskrnl.exe

KeInitializeSpinLock IoCreateDevice KeSetEvent ExUnregisterCallback IofCompleteRequest KefAcquireSpinLockAtDpcLevel IoReleaseCancelSpinLock KeWaitForSingleObject IofCallDriver KeClearEvent ZwPowerInformation ExRegisterCallback ExCreateCallback RtlInitUnicodeString RtlCopyUnicodeString IoBuildDeviceIoControlRequest strncpy ZwQueryValueKey RtlQueryRegistryValues RtlWriteRegistryValue wcslen RtlIntegerToUnicodeString IoFreeWorkItem IoBuildSynchronousFsdRequest MmMapIoSpace KeInitializeEvent RtlEqualUnicodeString ZwOpenKey MmUnmapIoSpace IoQueueWorkItem IoAllocateWorkItem _snwprintf RtlAnsiStringToUnicodeString RtlInitAnsiString READ_REGISTER_UCHAR READ_REGISTER_USHORT READ_REGISTER_ULONG WRITE_REGISTER_UCHAR WRITE_REGISTER_USHORT WRITE_REGISTER_ULONG IoWMIRegistrationControl swprintf PoCallDriver PoStartNextPowerIrp PoRequestPowerIrp MmLockPagableDataSection MmUnlockPagableImageSection IoWriteErrorLogEntry IoAllocateErrorLogEntry PoSetPowerState IoAttachDeviceToDeviceStack IoDeleteDevice IoDetachDevice KeBugCheckEx KeTickCount ExAllocatePoolWithTag ExFreePoolWithTag KeQueryActiveProcessors KeSetSystemAffinityThread KeRevertToUserAffinityThread ZwClose KeNumberProcessors

hal

WRITE_PORT_USHORT KfReleaseSpinLock KfAcquireSpinLock HalSetBusDataByOffset KeStallExecutionProcessor WRITE_PORT_ULONG KeQueryPerformanceCounter READ_PORT_ULONG READ_PORT_USHORT READ_PORT_UCHAR WRITE_PORT_UCHAR

wmilib.sys

WmiCompleteRequest WmiSystemControl WmiFireEvent

Name

.text

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

768B

Virtual Size

669B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

PAGELK

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Virus.Win32.TDSS.b.d93d059e1418ff3f3f87a657e451ba2f

ntoskrnl.exe

hal

wmilib.sys

generic