Static task
static1
General
-
Target
14bb3611d438dfae449941b90e05458c_JaffaCakes118
-
Size
137KB
-
MD5
14bb3611d438dfae449941b90e05458c
-
SHA1
d04bc77e3eccbe1ad4216cdc8c3eb50128c0c1d6
-
SHA256
d6db1a9d5e3004550623e3bddfcc1e14b8d0b758d6608e59f3bf19699452ee50
-
SHA512
c302b43646beeeb8450d8aa3cae5cf29be6ba82df8625fe39b5ad23fea56960d7b88605695f3811f02a07726c70bfa741c2d246141239634509d39586887d1ce
-
SSDEEP
3072:AFDQRBmZnDRF6J0vkjE/5cg61cJRDCASQ0ITQzUC:AFQXwnDR4u1mg1p4j
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 14bb3611d438dfae449941b90e05458c_JaffaCakes118
Files
-
14bb3611d438dfae449941b90e05458c_JaffaCakes118.sys windows:5 windows x86 arch:x86
33f4913359cc9c5504477d0b154e82da
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoCreateDevice
IoDeleteDevice
ZwClose
RtlUnicodeStringToAnsiString
sprintf
KeInitializeSpinLock
IofCompleteRequest
ObReferenceObjectByHandle
KeWaitForSingleObject
RtlFreeAnsiString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
PsCreateSystemThread
strncmp
strstr
KeQuerySystemTime
strncpy
MmIsAddressValid
ZwQuerySystemInformation
RtlImageDirectoryEntryToData
tolower
ExAllocatePool
ExFreePool
isupper
ZwQueryDirectoryFile
ZwDeleteFile
ZwOpenFile
ZwQueryInformationFile
ZwReadFile
RtlInitAnsiString
MmMapLockedPages
swprintf
KeDelayExecutionThread
ZwQueryValueKey
isdigit
RtlCompareUnicodeString
wcstombs
ZwEnumerateKey
ZwOpenKey
_wcsicmp
PsTerminateSystemThread
KeTickCount
ZwDeleteValueKey
ZwEnumerateValueKey
ZwDeleteKey
ZwCreateKey
ZwSetValueKey
ZwCreateFile
ZwWriteFile
ExAllocatePoolWithTag
ExFreePoolWithTag
KeInitializeSemaphore
KeReleaseSemaphore
KeReadStateSemaphore
RtlTimeToTimeFields
isspace
toupper
strchr
memcpy
memset
_except_handler3
Sections
.text Size: 93KB - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ