Static task
static1
General
-
Target
2a3b73d21b62e20cfc6ec8a944229561_JaffaCakes118
-
Size
745KB
-
MD5
2a3b73d21b62e20cfc6ec8a944229561
-
SHA1
cd429c22487074a2761a23eb7a2c01e00fa39d6c
-
SHA256
31ed11e2ac14421ca2501858036c059680138641b5bbc2f8cc1fccf66630a10a
-
SHA512
5ae1dd5b723450d36e557d0ef0fe4bc2318338051e0ce18b2284fffc676255977d52ab118fdce1dd9f890cfa4edd784d3e3b589cc42750aa808c999120c22d40
-
SSDEEP
12288:fAWg9btSGCHKy9HFqqIjr5TFBPBhq9olXBIQfkigRdskpg0sg7CFBS0Y/Xr6ZdVa:fAWObKj9odrPBPBhqClXzIRKkH7CXOfC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2a3b73d21b62e20cfc6ec8a944229561_JaffaCakes118
Files
-
2a3b73d21b62e20cfc6ec8a944229561_JaffaCakes118.sys windows:4 windows x86 arch:x86
2bada2a387b3f5dbba3be9ca7968567a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExAllocatePoolWithTag
RtlInitUnicodeString
KeWaitForSingleObject
ExFreePoolWithTag
IoDetachDevice
MmMapLockedPagesSpecifyCache
ZwOpenKey
IoBuildDeviceIoControlRequest
IoWMIRegistrationControl
MmGetSystemRoutineAddress
PoRequestPowerIrp
IoGetDeviceProperty
MmBuildMdlForNonPagedPool
IoInitializeRemoveLockEx
RtlUnicodeStringToAnsiString
IoReleaseRemoveLockEx
KeReleaseMutex
IoCreateSymbolicLink
IoReleaseRemoveLockAndWaitEx
IoGetAttachedDeviceReference
ExDeleteNPagedLookasideList
IoDisconnectInterrupt
IoGetDmaAdapter
MmUnlockPages
ZwQuerySystemInformation
Sections
.text Size: 314KB - Virtual size: 314KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 776B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 411KB - Virtual size: 411KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ