Static task
static1
General
-
Target
abd520f7468d12d0ebc25a45ab4c06a4_JaffaCakes118
-
Size
71KB
-
MD5
abd520f7468d12d0ebc25a45ab4c06a4
-
SHA1
90b5f36ea3138b40f7178973fe40bf71b554a6ca
-
SHA256
d7adffb83bb339a044246a8786a505b441692b28544ece9c211a738b599c123e
-
SHA512
d5ba0b9d1c39f3f5a054d9089b5f510c21cd3073270ab4743595b0e3b0f14f4cd2329e241e2a6e403ef29f1310183b476362cad716888d599a3a4f9bcde6a5c6
-
SSDEEP
1536:YopAI0IVKaOUyNHhcgE5SRCYLBAfytNtemK:YotpVK0GhcvEPLBKGtem
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource abd520f7468d12d0ebc25a45ab4c06a4_JaffaCakes118
Files
-
abd520f7468d12d0ebc25a45ab4c06a4_JaffaCakes118.sys windows:4 windows x86 arch:x86
e4d5018239adc4a7d57290e9c40cebd2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExFreePoolWithTag
wcschr
_stricmp
strncpy
wcsncpy
strlen
RtlCompareMemory
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlInitUnicodeString
memset
KeInitializeMutex
KeWaitForSingleObject
KeReleaseMutex
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
KeQuerySystemTime
_aulldiv
RtlUnicodeStringToInteger
RtlTimeToTimeFields
_allmul
KeUnstackDetachProcess
KeStackAttachProcess
IofCompleteRequest
PoCallDriver
PoStartNextPowerIrp
IoDeleteDevice
IoAttachDeviceToDeviceStack
IoCreateDevice
ObfReferenceObject
IoGetRelatedDeviceObject
IoCreateFile
IoAttachDevice
IofCallDriver
IoGetCurrentProcess
_purecall
RtlWriteRegistryValue
RtlCreateRegistryKey
swprintf
ExAllocatePoolWithTag
RtlFreeUnicodeString
MmGetSystemRoutineAddress
strcmp
MmUnlockPages
IoFreeMdl
MmProbeAndLockPages
IoAllocateMdl
RtlCopyUnicodeString
DbgPrint
KeNumberProcessors
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
RtlQueryRegistryValues
PsGetVersion
IoRegisterShutdownNotification
KeSetEvent
KeInitializeEvent
KeGetCurrentThread
ObfDereferenceObject
RtlCompareUnicodeString
ObQueryNameString
ObReferenceObjectByName
IoDriverObjectType
IoFreeIrp
ObInsertObject
IoAllocateIrp
SeSetAccessStateGenericMapping
RtlMapGenericMask
SeCreateAccessState
ObCreateObject
IoFileObjectType
IoBuildDeviceIoControlRequest
IoCancelIrp
KeWaitForMultipleObjects
KeResetEvent
KeClearEvent
IoCreateSynchronizationEvent
KeSetPriorityThread
KeBugCheckEx
MmIsAddressValid
strchr
ZwWriteFile
ZwReadFile
RtlDeleteRegistryValue
memcpy
RtlUnwind
hal
KfRaiseIrql
KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql
KfLowerIrql
Sections
.text Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pagecode Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ