Static task
static1
Behavioral task
behavioral1
Sample
a7385ba0515eb4ef38784e58b33dd15e_JaffaCakes118.sys
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a7385ba0515eb4ef38784e58b33dd15e_JaffaCakes118.sys
Resource
win10v2004-20240802-en
General
-
Target
a7385ba0515eb4ef38784e58b33dd15e_JaffaCakes118
-
Size
150KB
-
MD5
a7385ba0515eb4ef38784e58b33dd15e
-
SHA1
615ffce42f0dc274c3601c054ea71cf35c996d48
-
SHA256
f15a3be456f11bf466299d80d907493ce1e9947c17ce54a976929cfb60c77234
-
SHA512
81c5454608ff10215a597aad2a819e481e767a1b6d3736b339d31a7953793110e83e159533ec769626ec8209903258ab0f4e8013760a810a33ab64bda1422fb2
-
SSDEEP
3072:UI7M7QbIpCpiEPPXuaSEYDW/veASQ0IQrmW:UIQ7QbLjH5ScCr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a7385ba0515eb4ef38784e58b33dd15e_JaffaCakes118
Files
-
a7385ba0515eb4ef38784e58b33dd15e_JaffaCakes118.sys .ps1 windows:5 windows x86 arch:x86 polyglot
d7fd024870e6e4f69db2fe05570b26ec
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
sprintf
IofCompleteRequest
KeInitializeSpinLock
ObReferenceObjectByHandle
KeWaitForSingleObject
RtlFreeAnsiString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
PsCreateSystemThread
strncmp
strstr
KeQuerySystemTime
strncpy
MmIsAddressValid
RtlInitUnicodeString
wcsncpy
RtlInitAnsiString
wcsncat
IoDriverObjectType
ObReferenceObjectByName
ExAllocatePoolWithTag
ExFreePoolWithTag
KeDelayExecutionThread
ZwReadFile
ZwCreateFile
ZwQueryInformationFile
ZwWriteFile
ZwQuerySystemInformation
RtlImageDirectoryEntryToData
tolower
ExAllocatePool
ExFreePool
isupper
RtlUnicodeStringToAnsiString
ZwOpenFile
ZwQueryDirectoryFile
ZwDeleteFile
MmMapLockedPages
ZwQueryValueKey
isdigit
RtlCompareUnicodeString
wcstombs
ZwEnumerateKey
_wcsicmp
ZwOpenKey
swprintf
ProbeForRead
ZwDeleteValueKey
ZwSetValueKey
ObQueryNameString
ZwEnumerateValueKey
KeServiceDescriptorTable
ObfDereferenceObject
ZwOpenDirectoryObject
ZwQueryDirectoryObject
PsTerminateSystemThread
KeTickCount
ZwDeleteKey
ZwCreateKey
KeInitializeSemaphore
KeReleaseSemaphore
KeReadStateSemaphore
RtlTimeToTimeFields
isspace
strchr
toupper
ZwClose
IoCreateDevice
IoDeleteDevice
memcpy
memset
_except_handler3
hal
KfLowerIrql
KeGetCurrentIrql
KfRaiseIrql
Sections
.text Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ