Static task
static1
General
-
Target
46aff81608fb8d7dbe4d5feb5f47f5b4_JaffaCakes118
-
Size
58KB
-
MD5
46aff81608fb8d7dbe4d5feb5f47f5b4
-
SHA1
72d2ec855b85ac2cba2810f4d552858ad09bcabe
-
SHA256
0689cfe49c6a6c6aaf13a409ce401e4385e7126206cfe4841d7251d67f61a79d
-
SHA512
e4c1ffb9e30fe31480adde205d871edeb29d4725f0050bf0c2e0351b05fa3922d9171dc9a29220e1103665d1917dda139b87f5f706cd1a90d2a32d925058b457
-
SSDEEP
768:M6MbADIO2Q5FH85LWs089kzxLEar0gaqP4AerOJ+Ge241X82IKqbk89f+bh:EJQb85LWT8sxLJQL2VerOJfNLk89eh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 46aff81608fb8d7dbe4d5feb5f47f5b4_JaffaCakes118
Files
-
46aff81608fb8d7dbe4d5feb5f47f5b4_JaffaCakes118.sys windows:4 windows x86 arch:x86
dc15d8ac2bd63731705e9809cdf3e073
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeBugCheckEx
KeTickCount
_allshl
RtlAppendUnicodeToString
RtlEqualUnicodeString
RtlCompareMemory
READ_REGISTER_UCHAR
KeQuerySystemTime
IoWMIWriteEvent
ExfInterlockedInsertHeadList
ZwCreateFile
ZwDeviceIoControlFile
ZwClose
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
ExInterlockedAddLargeInteger
KeEnterCriticalRegion
KeLeaveCriticalRegion
_aulldiv
_allmul
KeQueryInterruptTime
MmMapLockedPages
_alldiv
_allshr
RtlInitUnicodeString
RtlCompareUnicodeString
ExSetTimerResolution
KeQueryTimeIncrement
RtlCopyUnicodeString
RtlQueryRegistryValues
DbgPrint
KeInitializeSpinLock
ExfInterlockedInsertTailList
IofCompleteRequest
ExAllocatePoolWithTag
ExFreePoolWithTag
KefAcquireSpinLockAtDpcLevel
KefReleaseSpinLockFromDpcLevel
hal
KfAcquireSpinLock
KfReleaseSpinLock
KeQueryPerformanceCounter
Sections
.text Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 206B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.PAGE1 Size: 256B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE