Static task
static1
General
-
Target
236e58cb7a59ef8dca86b4fc3d5d2fad_JaffaCakes118
-
Size
149KB
-
MD5
236e58cb7a59ef8dca86b4fc3d5d2fad
-
SHA1
172247da08aae345f29ad8a75e21398a620547d2
-
SHA256
4ea45c91937d7d1dbbe11614a3b6ced464e647d38d682e5188ef164e96732d41
-
SHA512
2c0a501ee05f5642cdc9b43214bb48e0d17b0a742a2609181f3dbbb3629e42f0fb3acab6b4a87e3352dc684f8e09f76b88149a84ec7492c01a1f669ae9e051e8
-
SSDEEP
3072:KUsqjoyBBGLgbUFa0g0skasmRjASQ0IuI:KUFjoyMd8Asf5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 236e58cb7a59ef8dca86b4fc3d5d2fad_JaffaCakes118
Files
-
236e58cb7a59ef8dca86b4fc3d5d2fad_JaffaCakes118.sys windows:5 windows x86 arch:x86
36fb2d1a570bd3dfee7ad4c583483fa9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
sprintf
IofCompleteRequest
KeInitializeSpinLock
ObReferenceObjectByHandle
KeWaitForSingleObject
RtlFreeAnsiString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
PsCreateSystemThread
strncmp
strstr
KeQuerySystemTime
strncpy
MmIsAddressValid
IoDriverObjectType
ObReferenceObjectByName
ExAllocatePoolWithTag
ExFreePoolWithTag
RtlInitUnicodeString
wcsncpy
RtlInitAnsiString
wcsncat
KeDelayExecutionThread
ZwReadFile
ZwCreateFile
ZwQueryInformationFile
ZwWriteFile
ZwQuerySystemInformation
RtlImageDirectoryEntryToData
tolower
ExAllocatePool
ExFreePool
isupper
RtlUnicodeStringToAnsiString
ZwQueryDirectoryFile
ZwDeleteFile
ZwOpenFile
MmMapLockedPages
isdigit
RtlCompareUnicodeString
wcstombs
ZwEnumerateKey
_wcsicmp
ZwOpenKey
swprintf
ZwQueryValueKey
ProbeForRead
ObQueryNameString
KeServiceDescriptorTable
ObfDereferenceObject
ZwOpenDirectoryObject
ZwQueryDirectoryObject
PsTerminateSystemThread
KeTickCount
ZwDeleteValueKey
ZwEnumerateValueKey
ZwDeleteKey
ZwCreateKey
ZwSetValueKey
KeInitializeSemaphore
KeReleaseSemaphore
KeReadStateSemaphore
RtlTimeToTimeFields
isspace
strchr
toupper
ZwClose
IoCreateDevice
IoDeleteDevice
memcpy
memset
_except_handler3
hal
KeGetCurrentIrql
KfRaiseIrql
KfLowerIrql
Sections
.text Size: 101KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ