__ExInterlockedInsertHeadList@8
__ExInterlockedInsertTailList@0
Static task
static1
1 signatures
General
-
Target
07d00b65130039b17c6808262276a845_JaffaCakes118
-
Size
31KB
-
MD5
07d00b65130039b17c6808262276a845
-
SHA1
01f121fff55dbde406fd0b07a4047b54b9f05572
-
SHA256
41abbee90e7005c1d694a1bf42826c69f4fdb92de47146bfb2ace7fb6885b66a
-
SHA512
f390c59e751a24717526ed7d8214a25e5948d772ef6a3c61625323511a78cf11296d472cf32dcc18271673cc1f4189738dd28bd4aeebcc05c320d5917c816aef
-
SSDEEP
384:bdZR9HpK3lzd/+t1fBBVsdX3QePowTz+GrhaJJX3qDgy/u10XqEUi8F6cvuTCDVd:t9HglJkfFsX3PQW5gj1y/uu5Ui+Mfu
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 07d00b65130039b17c6808262276a845_JaffaCakes118
Files
-
07d00b65130039b17c6808262276a845_JaffaCakes118.sys windows:5 windows x86 arch:x86
23a19d678f98d40a33866c105eda9c74
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExFreePoolWithTag
ExAllocatePool
PsGetCurrentProcessId
IoAllocateDriverObjectExtension
IoAllocateIrp
RtlLookupElementGenericTableAvl
IoDeleteController
KeCancelTimer
ZwOpenTimer
IoGetDeviceObjectPointer
ZwOpenProcess
IoSetThreadHardErrorMode
RtlUpcaseUnicodeString
KeWaitForSingleObject
RtlValidSecurityDescriptor
RtlCreateSecurityDescriptor
KeInitializeDpc
RtlFindMostSignificantBit
KeAreApcsDisabled
strncpy
RtlInitUnicodeString
RtlRealSuccessor
RtlAnsiStringToUnicodeString
RtlCharToInteger
FsRtlIsTotalDeviceFailure
wcschr
_allmul
memset
MmUnmapVideoDisplay
MmMapVideoDisplay
MmGetVirtualForPhysical
Exports
Exports
Sections
.itext Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 624B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.init Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.export Size: 512B - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 860B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 298B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ