Static task
static1
General
-
Target
24d9052704f91ec7fae4de3ea2904744_JaffaCakes118
-
Size
38KB
-
MD5
24d9052704f91ec7fae4de3ea2904744
-
SHA1
e5fe39dc9a826eeb7883cb059304e8bb5168b4d0
-
SHA256
bf4fe64a2a6a280216ac3cf29c4394f8be013b21d263fd9fc803668e3dca8de1
-
SHA512
271d791ab1832d8f31e6fd9f0792b527d02440476f2dbd1026da65d4c0af2c332460a6ea22be9d77aac494afe5864f1ee98ac23f26644ffe6163595ecd5da877
-
SSDEEP
768:sFdBT0981cbEf1doLNwPWPdw7CRsI+7I89TWJ82nE:WdBg9TbEf1doLNwIw+WIYISK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 24d9052704f91ec7fae4de3ea2904744_JaffaCakes118
Files
-
24d9052704f91ec7fae4de3ea2904744_JaffaCakes118.sys windows:4 windows x86 arch:x86
5505aa50396b4ea3fceb8ae56196521a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
ExFreePoolWithTag
_wcsnicmp
KeDelayExecutionThread
ZwWriteFile
ZwQueryValueKey
KeWaitForSingleObject
MmBuildMdlForNonPagedPool
KefReleaseSpinLockFromDpcLevel
PsCreateSystemThread
IoFreeMdl
NtClose
IoGetDeviceObjectPointer
ExInitializeNPagedLookasideList
ZwSetValueKey
KeSetEvent
MmMapLockedPages
ZwCreateKey
IoFreeIrp
IoAllocateIrp
memcpy
memset
ZwOpenKey
ExInterlockedPopEntrySList
KefAcquireSpinLockAtDpcLevel
IoAllocateMdl
ExInterlockedPushEntrySList
ZwSetInformationFile
KeInitializeEvent
KeGetCurrentThread
_wcsicmp
ExAllocatePoolWithTag
ZwFlushKey
ObfDereferenceObject
_stricmp
ZwDeleteKey
RtlUnwind
KeUnstackDetachProcess
KeInitializeApc
ZwQuerySystemInformation
MmGetPhysicalAddress
MmHighestUserAddress
PsGetVersion
PsLookupThreadByThreadId
PsLookupProcessByProcessId
KeStackAttachProcess
KeInsertQueueApc
hal
KfAcquireSpinLock
KfReleaseSpinLock
ndis.sys
NdisFreeMemory
NdisDeregisterProtocol
NdisRegisterProtocol
NdisAllocateBufferPool
NdisAllocateBuffer
NdisCloseAdapter
NdisFreePacket
NdisOpenAdapter
NdisAllocateMemoryWithTag
NdisFreeBufferPool
NdisAllocatePacketPool
NdisAllocatePacket
NdisFreePacketPool
Sections
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ