Static task
static1
General
-
Target
064886c5cb243c517bd9a03a934538ba_JaffaCakes118
-
Size
131KB
-
MD5
064886c5cb243c517bd9a03a934538ba
-
SHA1
beb169cce7855f05fa92040cf23843cc80c0557d
-
SHA256
c06d72943f9adb28b5ef2bda8a76ff0b6fc34582654b86c86436530c5f037ebb
-
SHA512
be815ef4af18b9d8db912f838c4e9ac99ff575bb3e029d251c8eb76c578ddb0c37acb5fc52c21cf5d100cec38b27cc44565cbec2e00a5f6f5829c57bec51ae9e
-
SSDEEP
3072:INuzc3XRoS4/cLCUg4zoFtSDlohBijVWRGg7udmZ3z6ovOHiOmv:JdELbbsF2w6VWR0O3vvIiv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 064886c5cb243c517bd9a03a934538ba_JaffaCakes118
Files
-
064886c5cb243c517bd9a03a934538ba_JaffaCakes118.sys windows:4 windows x86 arch:x86
c656051230313bf23d08f3484862f43f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExAllocatePoolWithTag
KeBugCheckEx
RtlInitUnicodeString
KeInitializeEvent
KeSetEvent
IoDeleteDevice
IoFreeIrp
ObfDereferenceObject
IoAttachDeviceToDeviceStack
IoDetachDevice
RtlFreeUnicodeString
MmMapLockedPagesSpecifyCache
KeInitializeDpc
ZwOpenKey
RtlQueryRegistryValues
RtlCopyUnicodeString
IoOpenDeviceRegistryKey
IoFreeMdl
ExFreePool
IoQueueWorkItem
IoAllocateMdl
IoAllocateWorkItem
IoBuildDeviceIoControlRequest
IoFreeWorkItem
IoWMIRegistrationControl
KeDelayExecutionThread
ObReferenceObjectByHandle
KeSetTimer
IoSetDeviceInterfaceState
IoCancelIrp
PoSetPowerState
IoRegisterDeviceInterface
ZwSetValueKey
KeReleaseSpinLockFromDpcLevel
MmBuildMdlForNonPagedPool
KeInsertQueueDpc
IoReleaseCancelSpinLock
RtlAnsiStringToUnicodeString
IoWMIWriteEvent
DbgPrint
RtlInitAnsiString
IoAllocateErrorLogEntry
IoBuildSynchronousFsdRequest
IoDeleteSymbolicLink
MmUnmapIoSpace
_vsnwprintf
IoAcquireRemoveLockEx
KeResetEvent
ObfReferenceObject
ZwCreateKey
KeInitializeMutex
IoCreateSymbolicLink
IoReleaseRemoveLockAndWaitEx
_vsnprintf
RtlIntegerToUnicodeString
IoGetAttachedDeviceReference
KeSetTimerEx
ExDeleteNPagedLookasideList
ExInitializeNPagedLookasideList
KeWaitForMultipleObjects
RtlWriteRegistryValue
IoInvalidateDeviceRelations
MmUnlockPages
KeSetPriorityThread
KeRemoveQueueDpc
ZwQuerySystemInformation
ExFreePoolWithTag
Sections
.text Size: 97KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 644B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ