Static task
static1
General
-
Target
3cf00164af2ce8da544c91035055f628_JaffaCakes118
-
Size
62KB
-
MD5
3cf00164af2ce8da544c91035055f628
-
SHA1
70a320eaec225a42b591036585d17ae234af92f5
-
SHA256
4497d3c818b46d0320c28bd8dc902d68a78a775fdf5635a23409f153abc2c4c6
-
SHA512
e7f2d682fa7ace8786cddb2f5e6f58ddf857c607887fe9ec3aeb35dabf624072f97c97b3262170630bfa93cef4ee492a1fd84d5808e936370793ab79b7e768ab
-
SSDEEP
192:0urY4FHCZoffmu6UEdSnoRMgHtp7LCaVWrtJ33/a0kWG/pTS5VOcH1u/wpoO:lY4FEeKU3sH/LhVW5l/bpG/pTSy8I4b
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3cf00164af2ce8da544c91035055f628_JaffaCakes118
Files
-
3cf00164af2ce8da544c91035055f628_JaffaCakes118.sys windows:5 windows x86 arch:x86
8461cf0c9127db5fc99df6f1746e6d13
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExFreePool
ExAllocatePoolWithTag
strncpy
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
RtlCompareMemory
sprintf
KeTickCount
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
IoFileObjectType
ZwOpenFile
ZwOpenKey
ZwCreateKey
ZwOpenProcess
ZwWriteFile
ZwCreateFile
KeServiceDescriptorTable
ZwQuerySystemInformation
strstr
DbgPrint
IofCompleteRequest
ZwClose
ZwSetValueKey
KeWaitForSingleObject
KeInitializeEvent
KeSetPriorityThread
KeGetCurrentThread
RtlInitUnicodeString
PsCreateSystemThread
KeInitializeMutex
IoDeleteDevice
IoCreateSymbolicLink
KeInitializeSpinLock
IoCreateDevice
KeReleaseMutex
KeQuerySystemTime
InterlockedIncrement
vsprintf
IoGetCurrentProcess
PsGetVersion
_except_handler3
strncmp
hal
KfAcquireSpinLock
KfReleaseSpinLock
KeQueryPerformanceCounter
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ