Static task
static1
General
-
Target
b20422f94cfe5424b8c9b318ca766a89_JaffaCakes118
-
Size
393KB
-
MD5
b20422f94cfe5424b8c9b318ca766a89
-
SHA1
b65c2adb47b203abd0eed91c6bc5fd0451782573
-
SHA256
3e5c14ad94ce48632ee44ab73b26c617652c18482daae85a8ed00fb11567b100
-
SHA512
4ec88216ea30dd2e92ee75e94d93f64597d4949f84a7d9e49a56baab68f273e713e5ae157ad1daabdbba62a266d254660a74271c5ff86a5bcdcd6a4f98841b6b
-
SSDEEP
6144:9g0ZpBBO0B6ChZsKVou0O+ahBW+XqgEwmDnwEswhDATBZ:XBOq6uZsKVdWfDnCwhDATb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b20422f94cfe5424b8c9b318ca766a89_JaffaCakes118
Files
-
b20422f94cfe5424b8c9b318ca766a89_JaffaCakes118.sys windows:6 windows x86 arch:x86
7933588655fc220320e82e2b9225dcdd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitUnicodeString
_allmul
_alldiv
ExRaiseStatus
ExAllocatePoolWithTagPriority
ExFreePoolWithTag
ZwQueryInformationProcess
RtlCompareUnicodeString
KeReleaseMutex
KeWaitForSingleObject
ZwEnumerateKey
ZwDeleteKey
ZwOpenKey
wcsncat
memset
IoDeleteDevice
KeDetachProcess
KeAttachProcess
PsLookupProcessByProcessId
ExAllocatePoolWithTag
KeInitializeMutex
memcpy
MmGetSystemRoutineAddress
RtlCopyUnicodeString
ZwOpenProcess
ZwQueryValueKey
ZwSetValueKey
ZwLoadDriver
ZwCreateKey
ZwReadFile
ZwCreateFile
ZwSetInformationFile
ZwWriteFile
ZwQueryInformationFile
ZwQueryVolumeInformationFile
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
swprintf
SeCreateClientSecurity
KeGetCurrentThread
KeQuerySystemTime
sprintf
RtlImageDirectoryEntryToData
RtlImageNtHeader
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
KeTickCount
KeBugCheckEx
ObfDereferenceObject
ZwClose
RtlUnwind
hal
KeGetCurrentIrql
Sections
.text Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 337KB - Virtual size: 337KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 896B - Virtual size: 776B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ