Static task
static1
General
-
Target
8a6dc88429d9e9b6754afb628da5c482_JaffaCakes118
-
Size
759KB
-
MD5
8a6dc88429d9e9b6754afb628da5c482
-
SHA1
f14722de224215a9fad5a91969c563fcae370cdc
-
SHA256
2c3d161ae25d1555b7dccc0deb733848caaa6c8a7fcc7845fdd2caced8e53726
-
SHA512
c54848a6818296e1dfa68378d7af18db4e143dad34aa6d58b6fb6b6f2510143c21c70bdfbbbad3e7b7ffb2d01c96d54071c528dea0c5b659df8df6bb55d116b8
-
SSDEEP
12288:pNm+7ylT3gO6/j1isc6WZ6SE+Nf9KgQtEeo21LsVVLFQb9s4esycm/5OIVE5p9bF:Dm+7yO/j19I6SEYf9KhEa0p7Vh3NVOZ2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8a6dc88429d9e9b6754afb628da5c482_JaffaCakes118
Files
-
8a6dc88429d9e9b6754afb628da5c482_JaffaCakes118.sys windows:4 windows x86 arch:x86
49b2c311b3087703fa9c5757cea216b0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExAllocatePoolWithTag
sprintf
ZwQuerySystemInformation
ExFreePoolWithTag
IoStartNextPacket
_vsnprintf
RtlAddAccessAllowedAce
IoBuildDeviceIoControlRequest
IoGetDeviceInterfaces
KeWaitForMutexObject
IoWriteErrorLogEntry
RtlConvertLongToLargeInteger
wcscat
KeQueryPriorityThread
IoDeleteDevice
IoInitializeIrp
PoSetSystemState
IoCreateDriver
IoGetDmaAdapter
_itoa
RtlAppendStringToString
IoCreateDevice
strspn
IoAdapterObjectType
MmGetSystemRoutineAddress
IoGetDeviceInterfaceAlias
MmMapViewOfSection
IoGetAttachedDeviceReference
NtNotifyChangeDirectoryFile
SeCreateAccessState
KeReadStateEvent
_strrev
FsRtlFastUnlockAll
KeWaitForSingleObject
RtlAppendUnicodeStringToString
MmForceSectionClosed
IoCreateFile
ExInitializeNPagedLookasideList
Exi386InterlockedIncrementLong
MmMapViewInSessionSpace
wcsncat
FsRtlFastCheckLockForRead
NtDeleteFile
ZwUnloadKey
MmUnlockPagableImageSection
IoQueueWorkItem
PoUnregisterSystemState
KeRemoveByKeyDeviceQueue
LsaLookupAuthenticationPackage
RtlLargeIntegerShiftLeft
SeAuditHardLinkCreation
RtlInitializeUnicodePrefix
IoReportDetectedDevice
RtlEqualUnicodeString
KeGetCurrentThread
toupper
FsRtlIsNtstatusExpected
PsReturnPoolQuota
MmGetPhysicalMemoryRanges
MmAddPhysicalMemory
RtlAllocateHeap
PfxInitialize
KeUnstackDetachProcess
IoCreateSymbolicLink
IoCheckQuerySetVolumeInformation
RtlUpperChar
CcPinRead
_wcsupr
ExLocalTimeToSystemTime
FsRtlNotifyUninitializeSync
InitSafeBootMode
isdigit
RtlEqualLuid
RtlLargeIntegerSubtract
ObReferenceObjectByHandle
IoQueryFileInformation
RtlUpcaseUnicodeString
RtlFindClearRuns
Sections
.text Size: 364KB - Virtual size: 364KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 339B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 377KB - Virtual size: 377KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ