Static task
static1
General
-
Target
2f0d0018ac36327a76ad7ae5291aa7f1_JaffaCakes118
-
Size
46KB
-
MD5
2f0d0018ac36327a76ad7ae5291aa7f1
-
SHA1
03b1e157797984b9ce0f77c963eddcd3852e07a8
-
SHA256
741f56ad325e25d369260626abb5fb3fdf39ad375874895abf73417494021b4c
-
SHA512
758d2728b424e65d973aa44802e2d00b7a428c307dde16bf87f6ef4d96fc9113a9b1448e08438339c44d8826061e5d2742ae0ad157a6498337cddf4f227ee06c
-
SSDEEP
384:yVS2dEzd7v2ddDVwuaeKvWO2PAikCB7Laa/dGdB7r6ZTqCoCcJM1lN:yiedWZeSrBdCtLaa1gBfYt/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2f0d0018ac36327a76ad7ae5291aa7f1_JaffaCakes118
Files
-
2f0d0018ac36327a76ad7ae5291aa7f1_JaffaCakes118.sys windows:4 windows x86 arch:x86
9a02530d26d1be93ee5c1d6c45a90cd3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
wcsncat
ZwMapViewOfSection
ExInterlockedInsertHeadList
IoUnregisterFileSystem
ExInterlockedExtendZone
wcscspn
NtWaitForSingleObject
SeSetSecurityDescriptorInfoEx
ExFreePoolWithTag
Mm64BitPhysicalAddress
IoIsFileOriginRemote
Ke386CallBios
ZwDeleteKey
KeInsertHeadQueue
KeI386MachineType
Exfi386InterlockedDecrementLong
ExCreateCallback
ExfInterlockedInsertHeadList
RtlInitializeSid
RtlUpcaseUnicodeStringToCountedOemString
islower
RtlEnumerateGenericTable
NtSetInformationProcess
MmIsRecursiveIoFault
_snwprintf
NtQueryVolumeInformationFile
sprintf
MmForceSectionClosed
RtlInitString
IoWriteTransferCount
IoCallDriver
RtlExtendedIntegerMultiply
RtlDeleteAtomFromAtomTable
ObInsertObject
IoStartNextPacketByKey
RtlCaptureContext
IoBuildDeviceIoControlRequest
RtlNtStatusToDosErrorNoTeb
IoCreateUnprotectedSymbolicLink
RtlFindUnicodePrefix
ZwFsControlFile
MmGetPhysicalMemoryRanges
IoCreateNotificationEvent
RtlInitAnsiString
IoCheckDesiredAccess
FsRtlAddToTunnelCache
ZwSetDefaultUILanguage
HalPrivateDispatchTable
ExReinitializeResourceLite
RtlDeleteRegistryValue
SeReleaseSecurityDescriptor
RtlDescribeChunk
ZwCreateSection
hal
HalRequestIpi
KeAcquireSpinLock
HalClearSoftwareInterrupt
KeQueryPerformanceCounter
KeQueryPerformanceCounter
ExAcquireFastMutex
KeRaiseIrqlToDpcLevel
HalSetProfileInterval
HalGetEnvironmentVariable
HalReadDmaCounter
ExTryToAcquireFastMutex
HalSystemVectorDispatchEntry
HalSetProfileInterval
KeQueryPerformanceCounter
IoFreeMapRegisters
KeRaiseIrql
HalStopProfileInterrupt
HalAllProcessorsStarted
HalHandleNMI
READ_PORT_USHORT
HalQueryDisplayParameters
READ_PORT_BUFFER_UCHAR
IoReadPartitionTable
KfAcquireSpinLock
IoMapTransfer
KdComPortInUse
KeGetCurrentIrql
HalStartNextProcessor
KeReleaseQueuedSpinLock
KfRaiseIrql
WRITE_PORT_BUFFER_ULONG
ExAcquireFastMutex
HalAdjustResourceList
HalSystemVectorDispatchEntry
READ_PORT_USHORT
IoSetPartitionInformation
HalAllProcessorsStarted
IoFlushAdapterBuffers
READ_PORT_UCHAR
KeRaiseIrqlToDpcLevel
HalRequestSoftwareInterrupt
KeRaiseIrqlToSynchLevel
HalGetEnvironmentVariable
IoReadPartitionTable
IoWritePartitionTable
HalGetBusData
HalSetTimeIncrement
HalFlushCommonBuffer
ExReleaseFastMutex
READ_PORT_USHORT
KfLowerIrql
ExReleaseFastMutex
IoFlushAdapterBuffers
HalStartProfileInterrupt
READ_PORT_UCHAR
READ_PORT_BUFFER_ULONG
HalRequestIpi
HalGetEnvironmentVariable
IoFreeMapRegisters
Sections
.text Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 128B - Virtual size: 128B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 32B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ