Static task
static1
General
-
Target
332fa3583ec2903b25709394f639dc97_JaffaCakes118
-
Size
724KB
-
MD5
332fa3583ec2903b25709394f639dc97
-
SHA1
13c05e3bb35ee9e75e4764eba835754e78a0ff83
-
SHA256
377ec4164652a8e29942dc2f7998f896d7280509abcf28af0c61db4d9269becf
-
SHA512
9695fbeeab10ac0ef3724842f06fe81dbb398d2a929bbfabf669739125e26a21797d2adb9fc9df768fdf76c6a937985f464a2b9ad43c31af5d3fc4346c0b4b16
-
SSDEEP
12288:wQvsvcTQuXu9rhMJvxEgSKjTUOsrj4W0GBh/U6H4clJ9dWbV0boBM3d:svhu6FMJssQOsHs6429d8V0boB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 332fa3583ec2903b25709394f639dc97_JaffaCakes118
Files
-
332fa3583ec2903b25709394f639dc97_JaffaCakes118.sys windows:4 windows x86 arch:x86
e0ce04655a5492fc35566a3032a3c164
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExAllocatePoolWithTag
KeBugCheckEx
KeSetEvent
IofCallDriver
ZwClose
ExFreePoolWithTag
IoCreateDevice
IoFreeIrp
ObfDereferenceObject
PoStartNextPowerIrp
MmMapLockedPagesSpecifyCache
ZwOpenKey
RtlQueryRegistryValues
RtlCopyUnicodeString
KeCancelTimer
IoAllocateMdl
KeInitializeTimer
IoBuildDeviceIoControlRequest
IoWMIRegistrationControl
KeDelayExecutionThread
KeSetTimer
IoSetDeviceInterfaceState
IoRegisterDeviceInterface
KeReleaseSpinLockFromDpcLevel
MmBuildMdlForNonPagedPool
KeInsertQueueDpc
IoReleaseCancelSpinLock
PsTerminateSystemThread
IoWMIWriteEvent
DbgPrint
IoAllocateErrorLogEntry
_vsnwprintf
IoAcquireRemoveLockEx
RtlUnicodeStringToAnsiString
IoReleaseRemoveLockEx
ZwCreateKey
KeReleaseMutex
RtlAppendUnicodeStringToString
IoReleaseRemoveLockAndWaitEx
_vsnprintf
RtlIntegerToUnicodeString
KeSetTimerEx
ExDeleteNPagedLookasideList
IoConnectInterrupt
IoInvalidateDeviceRelations
ZwQuerySystemInformation
Sections
.text Size: 319KB - Virtual size: 318KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 385KB - Virtual size: 385KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ