Static task
static1
General
-
Target
81ce8640086be8252c3d9816a0724942_JaffaCakes118
-
Size
724KB
-
MD5
81ce8640086be8252c3d9816a0724942
-
SHA1
562e19f82d90873368459b32b9cb69258d5fad54
-
SHA256
6549478124261fae093726700bb4b6305e4fe0bec4818b4277297e5bf3b6a4a8
-
SHA512
fcb8fc66ba269eb5fe1e312ef37fb8234362f49d6b5062da297b5baae20953cf9780f0530df9577c7f11a7fbc3ca0c4cb744bf26752b92158e8d18a585460761
-
SSDEEP
12288:k7VbkIsWSdiNP/tYlPWwHwMWfBHNbdWqEwfkT3J0WZkG94jfCjZ6YGyIj/a0dGVn:k7VutIvfGWfVNpWqEbzhZ/9488mKnhmD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 81ce8640086be8252c3d9816a0724942_JaffaCakes118
Files
-
81ce8640086be8252c3d9816a0724942_JaffaCakes118.sys windows:4 windows x86 arch:x86
6dbdca8f1d05121ecbbb5250aeed17eb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExAllocatePoolWithTag
KeBugCheckEx
KeWaitForSingleObject
IofCompleteRequest
RtlCompareMemory
IoDeleteDevice
IoCreateDevice
ZwQueryValueKey
PoCallDriver
IoFreeIrp
ObfDereferenceObject
PoStartNextPowerIrp
IoAttachDeviceToDeviceStack
IoDetachDevice
KeInitializeDpc
RtlCopyUnicodeString
IoOpenDeviceRegistryKey
IoFreeMdl
KeCancelTimer
ExFreePool
IoAllocateMdl
KeInitializeTimer
IoAllocateWorkItem
IoBuildDeviceIoControlRequest
IoFreeWorkItem
KeDelayExecutionThread
KeClearEvent
ObReferenceObjectByHandle
KeSetTimer
IoCancelIrp
PoSetPowerState
IoRegisterDeviceInterface
MmGetSystemRoutineAddress
KeReleaseSpinLockFromDpcLevel
PoRequestPowerIrp
MmBuildMdlForNonPagedPool
IoReleaseCancelSpinLock
PsTerminateSystemThread
RtlInitAnsiString
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
IoDeleteSymbolicLink
_vsnwprintf
IoAcquireRemoveLockEx
RtlUnicodeStringToAnsiString
MmMapIoSpace
IoReleaseRemoveLockEx
RtlAppendUnicodeStringToString
KeInitializeMutex
IoCreateSymbolicLink
_vsnprintf
RtlIntegerToUnicodeString
IoGetAttachedDeviceReference
KeSetTimerEx
ExDeleteNPagedLookasideList
ExInitializeNPagedLookasideList
KeWaitForMultipleObjects
IoDisconnectInterrupt
ZwCreateFile
RtlWriteRegistryValue
MmProbeAndLockPages
IoInvalidateDeviceRelations
MmUnlockPages
KeRemoveQueueDpc
IoGetDeviceObjectPointer
ZwQuerySystemInformation
ExFreePoolWithTag
Sections
.text Size: 318KB - Virtual size: 317KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 385KB - Virtual size: 385KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ