Static task
static1
General
-
Target
b8738613584e3a514b4040a37e610a2b_JaffaCakes118
-
Size
132KB
-
MD5
b8738613584e3a514b4040a37e610a2b
-
SHA1
d23b310f95bfd59d6e2e7daf2d5a00dd898c9133
-
SHA256
0cfd8e2543a202f2bc42a58be7736fcb3f0329d89ecca23a3c61189002d696af
-
SHA512
6c39d4d5260b9b0307d71e7bc69b0524b8e1ce5dc4461b3ec45404a533b38b3c6b3a73af6c762a8cdb149e2cf8f20202076ce6f3514f96416f8e1c9c11cc3e70
-
SSDEEP
3072:jiizpEkK8N1It7E2yV1WlWblB+qU45q7Tl7Lfmn576UOZ9wb:jicEkK8N1f2yrxB+qU4Uvun5Ynw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b8738613584e3a514b4040a37e610a2b_JaffaCakes118
Files
-
b8738613584e3a514b4040a37e610a2b_JaffaCakes118.sys windows:4 windows x86 arch:x86
d3631ad105465c647e2c60470442cd22
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeWaitForSingleObject
KeSetEvent
IofCallDriver
RtlCompareMemory
IoCreateDevice
PoCallDriver
ObfDereferenceObject
PoStartNextPowerIrp
IoAttachDeviceToDeviceStack
IoDetachDevice
RtlFreeUnicodeString
IoAllocateIrp
MmMapLockedPagesSpecifyCache
KeInitializeDpc
RtlQueryRegistryValues
IoOpenDeviceRegistryKey
IoFreeMdl
KeCancelTimer
ExFreePool
IoQueueWorkItem
IoAllocateMdl
KeInitializeTimer
IoAllocateWorkItem
IoFreeWorkItem
IoWMIRegistrationControl
KeDelayExecutionThread
ObReferenceObjectByHandle
KeSetTimer
IoSetDeviceInterfaceState
IoCancelIrp
IoRegisterDeviceInterface
ZwSetValueKey
KeReleaseSpinLockFromDpcLevel
PoRequestPowerIrp
IoGetDeviceProperty
KeAcquireSpinLockAtDpcLevel
MmBuildMdlForNonPagedPool
KeInsertQueueDpc
IoReleaseCancelSpinLock
PsTerminateSystemThread
RtlAnsiStringToUnicodeString
IoWMIWriteEvent
RtlInitAnsiString
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
IoDeleteSymbolicLink
_vsnwprintf
IoInitializeRemoveLockEx
RtlUnicodeStringToAnsiString
ObfReferenceObject
IoReleaseRemoveLockEx
ZwCreateKey
KeReleaseMutex
IoCreateSymbolicLink
RtlIntegerToUnicodeString
IoGetAttachedDeviceReference
KeSetTimerEx
ExInitializeNPagedLookasideList
IoAcquireCancelSpinLock
IoDisconnectInterrupt
ZwCreateFile
RtlWriteRegistryValue
MmProbeAndLockPages
IoInvalidateDeviceRelations
IoGetDmaAdapter
KeSetPriorityThread
KeRemoveQueueDpc
IoGetDeviceObjectPointer
ZwQuerySystemInformation
ExAllocatePoolWithTag
ExFreePoolWithTag
Sections
.text Size: 97KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 672B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ