_BlockConn@8
_InitConn@4
Static task
static1
1 signatures
General
-
Target
0bcc7df38b00bbda113c4f4c8f49ff54_JaffaCakes118
-
Size
31KB
-
MD5
0bcc7df38b00bbda113c4f4c8f49ff54
-
SHA1
b850e6662124c2b3024d54c272a98bf2e215d15a
-
SHA256
4951aa16a7a3e3dc9df79907c22b1560c3ccde0aaa69fa10f393635415be6538
-
SHA512
c5232abd37416969e66becb1f96c30366ccbc21019106babe9635a2f5fd524d611accfa68d3fdb3eb503516030d45a7a506edee44427cb38dca2bdc38d6380bb
-
SSDEEP
768:cgmH/P5sAuUmS/isW5ntfxOQ+HZCeZGfiZEAA3RmNsvv+y:cgi/xJm+W5XOQPeZNCRmDy
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0bcc7df38b00bbda113c4f4c8f49ff54_JaffaCakes118
Files
-
0bcc7df38b00bbda113c4f4c8f49ff54_JaffaCakes118.sys windows:5 windows x86 arch:x86
e060d0c172536f7891ba0db85b5227e7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExFreePoolWithTag
ExVerifySuite
MmQuerySystemSize
ExAllocatePool
MmProbeAndLockProcessPages
MmProbeAndLockPages
MmUnlockPages
_stricmp
strncat
_strnicmp
ObGetObjectSecurity
ZwQueryFullAttributesFile
VerSetConditionMask
_wcsnicmp
RtlSubtreeSuccessor
RtlAppendUnicodeToString
_wcsnset
RtlUnicodeStringToAnsiString
MmMapUserAddressesToPage
RtlCompareString
RtlDeleteNoSplay
ZwMakeTemporaryObject
RtlAppendUnicodeStringToString
RtlFreeAnsiString
IoAttachDeviceToDeviceStack
MmIsThisAnNtAsSystem
ZwDeviceIoControlFile
ObfDereferenceObject
RtlUnicodeStringToInteger
ObReleaseObjectSecurity
RtlUpcaseUnicodeChar
ZwOpenSection
ZwOpenKey
memset
Exports
Exports
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 400B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
const Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 1012B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 332B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ