Static task
static1
General
-
Target
25526e801ef69ae1204480e15055db26_JaffaCakes118
-
Size
131KB
-
MD5
25526e801ef69ae1204480e15055db26
-
SHA1
98855e8efcbdcb84664fa2a5c14771db5b260c6e
-
SHA256
05220815dcf50f46e9993398c6125c004d733be5461db90a399aebf03eb9a87e
-
SHA512
3e32e9f7074832446af39ef3f05775b87c85be8f2b23927ad180b26c7fedaab58cc1a6d39118c8f351a6c34576ac95a2fcc4c49f7872426e0be50ec38dfa1a5a
-
SSDEEP
1536:Pw4PGhD4kXk2RRuSFEY3iL51Bbzmb+27qb7fDhMWlzZ5Qywj/KswRzZ1v4bShsNl:NehskXk26201sVQ7imPRzZ6f/jvZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 25526e801ef69ae1204480e15055db26_JaffaCakes118
Files
-
25526e801ef69ae1204480e15055db26_JaffaCakes118.sys windows:5 windows x86 arch:x86
0f40d8e31976857d9c829b18101afdc3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
_abnormal_termination
KeBugCheckEx
RtlSetBits
RtlClearBits
RtlInitializeBitMap
ExAllocatePoolWithTag
RtlFindClearBits
CcSetFileSizes
CcInitializeCacheMap
_allshr
_allshl
ExReleaseResourceLite
ExAcquireResourceSharedLite
FsRtlNumberOfRunsInMcb
FsRtlUninitializeMcb
FsRtlInitializeMcb
RtlFindLongestRunClear
RtlAreBitsClear
ExAcquireResourceExclusiveLite
FsRtlTruncateMcb
CcMapData
InterlockedIncrement
IoCreateStreamFileObject
CcSetAdditionalCacheAttributes
FsRtlNormalizeNtstatus
IoSetHardErrorOrVerifyDevice
CcPurgeCacheSection
CcGetFileObjectFromBcb
CcZeroData
CcMdlReadComplete
CcMdlWriteComplete
KeWaitForSingleObject
CcUninitializeCacheMap
KeInitializeEvent
CcPinMappedData
CcPinRead
ObfDereferenceObject
CcFlushCache
KeSetTimer
KeRemoveQueueDpc
KeCancelTimer
KeQuerySystemTime
CcSetDirtyPinnedData
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
FsRtlNotifyVolumeEvent
FsRtlOplockIsFastIoPossible
FsRtlCheckOplock
IoRemoveShareAccess
FsRtlFastUnlockAll
IoGetRequestorProcess
FsRtlNotifyFullReportChange
FsRtlIsNtstatusExpected
FsRtlNotifyCleanup
FsRtlNotifyFullChangeDirectory
KeLeaveCriticalRegion
IoSetTopLevelIrp
KeEnterCriticalRegion
IofCompleteRequest
ExQueueWorkItem
InterlockedDecrement
IoGetCurrentProcess
ExGetSharedWaiterCount
ExGetExclusiveWaiterCount
FsRtlLegalAnsiCharacterArray
IoSetShareAccess
IoCheckShareAccess
CcIsThereDirtyData
MmCanFileBeTruncated
IoUpdateShareAccess
SeSinglePrivilegeCheck
MmFlushImageSection
FsRtlCurrentBatchOplock
FsRtlFindInTunnelCache
FsRtlIsFatDbcsLegal
RtlUpcaseUnicodeString
RtlDowncaseUnicodeString
RtlUpcaseUnicodeStringToCountedOemString
FsRtlDissectName
memmove
IofCallDriver
IoIsOperationSynchronous
KeClearEvent
KeSetEvent
IoFreeIrp
IoFreeMdl
ExReleaseResourceForThreadLite
ExfInterlockedAddUlong
FsRtlIsTotalDeviceFailure
MmProbeAndLockPages
IoAllocateMdl
MmMapLockedPagesSpecifyCache
ExAllocatePoolWithQuotaTag
IoBuildDeviceIoControlRequest
KeDelayExecutionThread
IoBuildPartialMdl
IoMakeAssociatedIrp
KeGetCurrentThread
MmUnlockPages
ExLocalTimeToSystemTime
RtlOemToUnicodeN
RtlxOemStringToUnicodeSize
NlsMbOemCodePageTag
RtlFreeOemString
FsRtlDoesNameContainWildCards
ExConvertExclusiveToSharedLite
FsRtlAddToTunnelCache
RtlOemStringToCountedUnicodeString
FsRtlDeleteKeyFromTunnelCache
ExSystemTimeToLocalTime
_allmul
CcRepinBcb
FsRtlAreNamesEqual
FsRtlIsNameInExpression
FsRtlUninitializeLargeMcb
FsRtlGetNextLargeMcbEntry
FsRtlNumberOfRunsInLargeMcb
FsRtlAddLargeMcbEntry
FsRtlInitializeLargeMcb
IoCheckEaBufferValidity
RtlUpperString
RtlCompareString
NlsOemLeadByteInfo
CcCopyWrite
IoGetTopLevelIrp
FsRtlFastCheckLockForWrite
FsRtlFastCheckLockForRead
IoRaiseInformationalHardError
IoIsSystemThread
IoRaiseHardError
IoSetDeviceToVerify
IoGetDeviceToVerify
MmGetSystemRoutineAddress
RtlInitUnicodeString
ZwDeleteFile
ZwWriteFile
ZwClose
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
RtlRandom
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
ZwDeleteKey
RtlDeleteRegistryValue
ZwEnumerateValueKey
ZwQueryKey
ZwOpenKey
ZwEnumerateKey
wcslen
ZwQueryValueKey
RtlCompareMemory
IoRegisterFileSystem
ExInitializePagedLookasideList
ExInitializeNPagedLookasideList
ExInitializeResourceLite
MmQuerySystemSize
KeInitializeSpinLock
FsRtlCopyWrite
FsRtlCopyRead
IoCreateDevice
FsRtlLookupLargeMcbEntry
FsRtlLookupLastLargeMcbEntryAndIndex
FsRtlRemoveLargeMcbEntry
FsRtlOplockFsctrl
CcWaitForCurrentLazyWriterActivity
ObReferenceObjectByHandle
IoFileObjectType
IoBuildSynchronousFsdRequest
KeNumberProcessors
ProbeForWrite
ProbeForRead
IoDeleteDevice
ObfReferenceObject
ExIsResourceAcquiredExclusiveLite
CcCanIWrite
FsRtlPrivateLock
FsRtlFastUnlockSingle
FsRtlFastUnlockAllByKey
FsRtlProcessFileLock
FsRtlIsDbcsInExpression
RtlUnicodeStringToCountedOemString
RtlGenerate8dot3Name
CcMdlRead
CcCopyRead
CcSetReadAheadGranularity
FsRtlCheckLockForReadAccess
IoGetStackLimits
FsRtlPostStackOverflow
FsRtlPostPagingFileStackOverflow
ExAcquireSharedWaitForExclusive
ExIsResourceAcquiredSharedLite
ExAllocateFromPagedLookasideList
ExFreeToPagedLookasideList
ExDeleteResourceLite
KeInitializeDpc
KeInitializeTimer
FsRtlNotifyInitializeSync
FsRtlInitializeTunnelCache
ExInterlockedPopEntrySList
ExInterlockedPushEntrySList
RtlFreeUnicodeString
FsRtlUninitializeFileLock
FsRtlUninitializeOplock
FsRtlInitializeOplock
FsRtlInitializeFileLock
FsRtlDeleteTunnelCache
FsRtlNotifyUninitializeSync
RtlDelete
RtlSplay
RtlTimeFieldsToTime
RtlTimeToTimeFields
FsRtlBalanceReads
FsRtlRemoveMcbEntry
RtlEqualString
IoVerifyVolume
IoBuildAsynchronousFsdRequest
_local_unwind2
CcPrepareMdlWrite
FsRtlCheckLockForWriteAccess
ExAcquireSharedStarveExclusive
CcDeferWrite
CcUnpinRepinnedBcb
ExRaiseStatus
CcUnpinData
ExFreePool
_alldiv
_except_handler3
hal
KfAcquireSpinLock
KfReleaseSpinLock
ExAcquireFastMutex
ExReleaseFastMutex
KeGetCurrentIrql
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ