Static task
static1
General
-
Target
b31e1df2c224a3ee0e1c7a5255c65267_JaffaCakes118
-
Size
9KB
-
MD5
b31e1df2c224a3ee0e1c7a5255c65267
-
SHA1
9aba7d89fe074e05e1a63f0a5a4faad16c325a1f
-
SHA256
0be2d4e9c3d6b2dfdfb14448c804e828a241cc0bc562ee1240477bd10526ab88
-
SHA512
f3ccc196af7d89e379af174205132c096effeb06a526eefaea3599e15915ba6fcaff60bce23c67fbe74f533991f10abf59b3d318e0b860e02c9f5005012dc3e6
-
SSDEEP
192:iBqE+9sVKHmFLlovJ19Zi9TuCvMJQP0SW1W15YnX/nZoD0AEdOr:mqE+emmF5WJ19Zi9qFWP0Dg15Yg0F
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b31e1df2c224a3ee0e1c7a5255c65267_JaffaCakes118
Files
-
b31e1df2c224a3ee0e1c7a5255c65267_JaffaCakes118.sys windows:5 windows x86 arch:x86
0d128c264e5e2d24331fc79e3ffaa9ba
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
strncmp
IoGetCurrentProcess
IofCompleteRequest
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
ExAllocatePoolWithTag
MmSizeOfMdl
ZwQueryInformationProcess
PsGetCurrentProcessId
DbgPrint
ProbeForWrite
ProbeForRead
RtlFreeAnsiString
_strlwr
strrchr
RtlUnicodeStringToAnsiString
MmIsAddressValid
_except_handler3
KeDelayExecutionThread
KeUnstackDetachProcess
ZwTerminateProcess
KeStackAttachProcess
PsLookupProcessByProcessId
PsTerminateSystemThread
ExFreePool
ZwQuerySystemInformation
KeSetPriorityThread
KeGetCurrentThread
ZwPulseEvent
MmGetSystemRoutineAddress
ZwClose
PsCreateSystemThread
PsSetLoadImageNotifyRoutine
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
IoDeleteDevice
IoDeleteSymbolicLink
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 768B - Virtual size: 760B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 448B - Virtual size: 444B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ