General
-
Target
2c1a0e13d8b327d18d71e0575d53089b_JaffaCakes118
-
Size
409KB
-
MD5
2c1a0e13d8b327d18d71e0575d53089b
-
SHA1
8396e16cd13d033eaaa14196ba925007f37630a9
-
SHA256
da6d53340b6cbe79365af91208fc191bd92221de9e1282ee88960e9d5504e7ec
-
SHA512
d4cc99e979d529cc750741f261fadfbfc6bfec0b5b6dfd862c0b1de6975e84e355a8d671fe86728664f617e7e7e8beca0dfa683b93eee8767ae617736a16ef18
-
SSDEEP
12288:8TYmq/mwrL5bLCq1zw2XkjnjioSYc9T8yfuu:8TYTm8L5bLCq1zwukelYclNf
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2c1a0e13d8b327d18d71e0575d53089b_JaffaCakes118
Files
-
2c1a0e13d8b327d18d71e0575d53089b_JaffaCakes118.sys windows:5 windows x86 arch:x86
0869d9a5e4e5fa2c2a70f4280477130c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
swprintf
KeTickCount
KeQuerySystemTime
KeDelayExecutionThread
IofCompleteRequest
ExFreePool
KeClearEvent
InterlockedIncrement
KeSetEvent
InterlockedDecrement
IoInvalidateDeviceRelations
RtlCopyUnicodeString
ExAllocatePoolWithTag
IoDeleteDevice
IoAttachDeviceToDeviceStack
KeInitializeEvent
IoCreateDevice
IoSetDeviceInterfaceState
KeLeaveCriticalRegion
KeEnterCriticalRegion
IoRequestDeviceEject
KeWaitForSingleObject
IofCallDriver
ObfReferenceObject
IoDetachDevice
PoCallDriver
PoStartNextPowerIrp
PoSetPowerState
ObfDereferenceObject
IoBuildSynchronousFsdRequest
IoGetAttachedDeviceReference
KeBugCheckEx
IoRegisterDeviceInterface
DbgPrint
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
hal
ExReleaseFastMutex
ExAcquireFastMutex
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 319B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 1024B - Virtual size: 588B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: 367KB - Virtual size: 366KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 676B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ