Static task
static1
General
-
Target
3c1f0afed62c3f49e139fdcef8aba907_JaffaCakes118
-
Size
445KB
-
MD5
3c1f0afed62c3f49e139fdcef8aba907
-
SHA1
bb4f02e235a42476587df3bfb5e46b19cddfb9ab
-
SHA256
337be335900666aa0a4337c792a789dd38a861e65145c49cec702d0f0bd8b21a
-
SHA512
720983510125a2d1c75913239fd6d5b8da331628295f93cfcda1237ed4ba18ac1df988335c5036fa602923246b05dedd52e3f95d11f45d57598c3d4eea787e56
-
SSDEEP
6144:0AHNkEhsOt8gbCCeglCeskyLwIcJ5puCOuF+53IykoNCDbRuNLdkzaE4:hKGcglC3kwwIcJCCrdo8o5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c1f0afed62c3f49e139fdcef8aba907_JaffaCakes118
Files
-
3c1f0afed62c3f49e139fdcef8aba907_JaffaCakes118.sys windows:4 windows x86 arch:x86
e3a28094fbd539304927e938476e2796
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
hal
KeAcquireQueuedSpinLock
ntoskrnl.exe
RtlInitUnicodeString
ZwCreateKey
ZwQueryValueKey
ExInitializeZone
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
SeExports
ObReleaseObjectSecurity
ExInterlockedDecrementLong
SeSetSecurityDescriptorInfo
ExAllocatePoolWithTag
RtlLengthSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
ObGetObjectSecurity
IoDeleteDevice
ExDeleteNPagedLookasideList
IoQueueWorkItem
ZwNotifyChangeKey
MmPageEntireDriver
IoFreeWorkItem
ExInitializeNPagedLookasideList
IoAllocateWorkItem
IoCreateDevice
DbgBreakPoint
KeReadStateEvent
KePulseEvent
MmAdvanceMdl
KeBugCheckEx
ExInterlockedFlushSList
KeSetTimerEx
KeInitializeDpc
KeInitializeTimer
MmLockPagableDataSection
KeSetTimer
MmUnlockPagableImageSection
KeRemoveQueueDpc
Sections
.text Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.INIT Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ