Static task
static1
General
-
Target
a1de76294c7613fc3517103305b5d1a0_JaffaCakes118
-
Size
8KB
-
MD5
a1de76294c7613fc3517103305b5d1a0
-
SHA1
8c24c6ddfb51bb3009ac5b44d9db60247e0eb90a
-
SHA256
08b38e9c48365e6bc4f71096b0b266a3d1f561bfecb4af06317cc835a677f4ee
-
SHA512
79cedac4f69bb3a8b5945cb88fcd6fe3928549db9e2536e01b13f9e35a0ae813d6ffb13e46ffef20be747304b08bd8b341214cb590eac79a416d6315ddaa0ccf
-
SSDEEP
96:AoGxjtch+7Kd/aUVJ+gQBAZ3kCP+P5Sa+mdSOLfEksJo0DuIV3e5kofzgSEnkH:AxNKMawgWAtfLmgOjBGDG1LgRk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a1de76294c7613fc3517103305b5d1a0_JaffaCakes118
Files
-
a1de76294c7613fc3517103305b5d1a0_JaffaCakes118.sys windows:4 windows x86 arch:x86
23b91f653455fe14db3c38c9fc600f9b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoGetDeviceObjectPointer
ObDereferenceObject
ObReferenceObjectByName
RtlAnsiStringToUnicodeString
RtlDelete
RtlDeleteAce
RtlDeleteAtomFromAtomTable
RtlDeleteElementGenericTable
RtlDeleteNoSplay
RtlDeleteOwnersRanges
RtlDeleteRange
RtlDeleteRegistryValue
RtlDescribeChunk
RtlDestroyAtomTable
RtlDestroyHeap
RtlDowncaseUnicodeString
RtlEmptyAtomTable
RtlEnlargedIntegerMultiply
RtlEnlargedUnsignedDivide
RtlEnlargedUnsignedMultiply
RtlEnumerateGenericTable
RtlEnumerateGenericTableWithoutSplaying
RtlEqualLuid
RtlEqualSid
RtlEqualString
RtlEqualUnicodeString
RtlExtendedIntegerMultiply
RtlExtendedLargeIntegerDivide
RtlExtendedMagicDivide
RtlFillMemory
RtlFillMemoryUlong
RtlFindClearBits
RtlFindClearBitsAndSet
RtlFindClearRuns
RtlFindFirstRunClear
RtlFindLastBackwardRunClear
RtlFindLeastSignificantBit
RtlFindLongestRunClear
RtlFindMessage
RtlFindMostSignificantBit
RtlFindNextForwardRunClear
RtlFindRange
RtlFindSetBits
RtlFindSetBitsAndClear
RtlFindUnicodePrefix
RtlFormatCurrentUserKeyPath
RtlFreeAnsiString
RtlFreeHeap
RtlFreeOemString
RtlFreeRangeList
RtlFreeUnicodeString
RtlGUIDFromString
RtlGenerate8dot3Name
IoGetCurrentProcess
RtlGetCallersAddress
RtlGetCompressionWorkSpaceSize
RtlGetDaclSecurityDescriptor
RtlGetDefaultCodePage
RtlGetElementGenericTable
RtlGetFirstRange
RtlGetGroupSecurityDescriptor
RtlGetNextRange
RtlGetNtGlobalFlags
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlImageDirectoryEntryToData
RtlImageNtHeader
RtlInitAnsiString
ZwAccessCheckAndAuditAlarm
ZwAdjustPrivilegesToken
ZwAlertThread
ZwAllocateVirtualMemory
ZwCancelIoFile
ZwCancelTimer
ZwClearEvent
ZwClose
ZwCloseObjectAuditAlarm
ZwConnectPort
ZwCreateDirectoryObject
ZwCreateEvent
ZwCreateFile
ZwCreateKey
ZwCreateSection
ZwCreateSymbolicLinkObject
ZwCreateTimer
ZwDeleteFile
ZwDeleteKey
ZwDeleteValueKey
ZwDeviceIoControlFile
ZwDisplayString
ZwDuplicateObject
ZwDuplicateToken
ZwEnumerateKey
ZwEnumerateValueKey
ZwFlushInstructionCache
ZwFlushKey
ZwFlushVirtualMemory
ZwFreeVirtualMemory
ZwFsControlFile
ZwOpenKey
ZwQueryDirectoryFile
ZwQuerySystemInformation
ZwSetValueKey
ZwTerminateProcess
ZwYieldExecution
KeServiceDescriptorTable
IoDriverObjectType
IoCallDriver
RtlGetAce
IoBuildDeviceIoControlRequest
ndis.sys
NdisRegisterProtocol
NdisDeregisterProtocol
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 480B - Virtual size: 475B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 608B - Virtual size: 608B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 672B - Virtual size: 660B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ