Static task
static1
General
-
Target
8ab9180b69e0ccf1d70ccafdfbc8e18b_JaffaCakes118
-
Size
743KB
-
MD5
8ab9180b69e0ccf1d70ccafdfbc8e18b
-
SHA1
51bc486d92b116699a8eb87b9e44c00f0cf4cd24
-
SHA256
cd4d84b9796d17439d4a08c62e5187f3de1c7d6fd9177c2a49322c89ea0fe6ba
-
SHA512
6e81cccb019f6e44f825bdfd45010d8c63f0430b60cb62417e9abb202866afe19062b31c5990942d5806dd6e15ee930c02e9b9bd16afb40fb9a4f23eaef8a964
-
SSDEEP
12288:EdU/Qd9nvx6WWYh68vWL2XQc1zA8mSM12GqqKnqLnseIQHfCbSLZOkx5Ahe5Yk1K:EdU+9p6JUzXlzAkMTKnqLnsECbSLZT1I
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8ab9180b69e0ccf1d70ccafdfbc8e18b_JaffaCakes118
Files
-
8ab9180b69e0ccf1d70ccafdfbc8e18b_JaffaCakes118.sys windows:4 windows x86 arch:x86
4c9804ea4994c9ccf60413b34794b0f6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExAllocatePoolWithTag
KeBugCheckEx
RtlInitUnicodeString
KeWaitForSingleObject
KeInitializeEvent
KeSetEvent
ZwClose
IofCompleteRequest
ExFreePoolWithTag
RtlCompareMemory
IoDeleteDevice
IoCreateDevice
ZwQueryValueKey
PoCallDriver
IoFreeIrp
PoStartNextPowerIrp
IoDetachDevice
RtlFreeUnicodeString
MmMapLockedPagesSpecifyCache
KeInitializeDpc
ZwOpenKey
RtlQueryRegistryValues
RtlCopyUnicodeString
IoOpenDeviceRegistryKey
IoFreeMdl
IoQueueWorkItem
IoAllocateMdl
KeInitializeTimer
IoAllocateWorkItem
IoBuildDeviceIoControlRequest
IoFreeWorkItem
KeDelayExecutionThread
KeClearEvent
ObReferenceObjectByHandle
IoSetDeviceInterfaceState
IoCancelIrp
PoSetPowerState
IoRegisterDeviceInterface
ZwSetValueKey
MmGetSystemRoutineAddress
PoRequestPowerIrp
PsCreateSystemThread
KeAcquireSpinLockAtDpcLevel
IoReleaseCancelSpinLock
PsTerminateSystemThread
RtlAnsiStringToUnicodeString
IoWMIWriteEvent
RtlInitAnsiString
IoAllocateErrorLogEntry
IoBuildSynchronousFsdRequest
IoDeleteSymbolicLink
MmUnmapIoSpace
IoAcquireRemoveLockEx
RtlUnicodeStringToAnsiString
RtlAppendUnicodeToString
ObfReferenceObject
IoReleaseRemoveLockEx
ZwCreateKey
KeQueryTimeIncrement
KeReleaseMutex
RtlAppendUnicodeStringToString
KeInitializeMutex
IoReleaseRemoveLockAndWaitEx
IoGetAttachedDeviceReference
KeSetTimerEx
ExDeleteNPagedLookasideList
IoAcquireCancelSpinLock
KeWaitForMultipleObjects
IoDisconnectInterrupt
RtlWriteRegistryValue
IoInvalidateDeviceRelations
MmUnlockPages
IoGetDeviceObjectPointer
ZwQuerySystemInformation
Sections
.text Size: 309KB - Virtual size: 309KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 300B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 414KB - Virtual size: 413KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ