Static task
static1
General
-
Target
337ac7faf8eac544063e27d83994d89b_JaffaCakes118
-
Size
445KB
-
MD5
337ac7faf8eac544063e27d83994d89b
-
SHA1
a2bfcefcf76f9467911cc59ed1056e399f02cfb4
-
SHA256
5363309f06fcfc6f328c4f7864aa3a73f1848a2dcae669404ade57bf3478b58c
-
SHA512
3a5c899f6cfeca997327ab2392e574dae5e83e5f1a091a859521f9a924d6050d813c01930bb23baeee842d40e5cb36a8539e26f0bae437358c8ff2f5daa52a83
-
SSDEEP
6144:+4ErxDZEKTHAJiKXi4LE4wxHObJ2LG24z/3nZr26tVrl/tg5o8jOcfDvecdQs:+BrDBtKy4LE4wxubJ2Li73ZpjgRdKWQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 337ac7faf8eac544063e27d83994d89b_JaffaCakes118
Files
-
337ac7faf8eac544063e27d83994d89b_JaffaCakes118.sys windows:4 windows x86 arch:x86
0bb332984621ba4a51bf4459445f9014
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
hal
KeAcquireQueuedSpinLock
KeAcquireInStackQueuedSpinLock
KfLowerIrql
KfRaiseIrql
KeGetCurrentIrql
KeReleaseQueuedSpinLock
KeReleaseInStackQueuedSpinLock
ntoskrnl.exe
KeInitializeDpc
KeInitializeTimer
MmLockPagableDataSection
KeSetTimer
MmUnlockPagableImageSection
KeRemoveQueueDpc
CcSetReadAheadGranularity
KeCancelTimer
_alldiv
RtlEqualUnicodeString
ExAllocatePoolWithQuota
MmUnmapLockedPages
IoCancelIrp
ExQueueWorkItem
FsRtlMdlReadComplete
KeDetachProcess
FsRtlMdlRead
KeAttachProcess
IoGetRequestorProcess
FsRtlCopyRead
IoQueryFileInformation
_aullrem
PsGetCurrentProcessId
ObFindHandleForObject
ObCloseHandle
ObOpenObjectByName
IoThreadToProcess
KeTickCount
KeInitializeApc
KeInsertQueueApc
KeAcquireInStackQueuedSpinLockAtDpcLevel
KeReleaseInStackQueuedSpinLockFromDpcLevel
ObfReferenceObject
IoAcquireCancelSpinLock
IoReleaseCancelSpinLock
memmove
ExFreePoolWithTag
IofCompleteRequest
IoFreeMdl
ObfDereferenceObject
ObReferenceObjectByHandle
ExGetPreviousMode
InterlockedPushEntrySList
tdi.sys
TdiReturnChainedReceives
TdiMatchPdoWithChainedReceiveContext
TdiDeregisterPnPHandlers
TdiRegisterPnPHandlers
TdiCopyMdlToBuffer
TdiCopyBufferToMdl
Sections
.text Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 234B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.PAGE Size: 256B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE