Static task
static1
General
-
Target
c17c9e41619823ce5afc3db33c14b0c1_JaffaCakes118
-
Size
131KB
-
MD5
c17c9e41619823ce5afc3db33c14b0c1
-
SHA1
1ec2f1a35ea4aa97fcbfcf85322d360d331427bf
-
SHA256
82677903a9410cd555e36336b52d2dc7b6871298b06e3813421a4bb447e3f702
-
SHA512
74cb700000b94d1fef715885da7fbae6d6fc391345ef14d456c73d549bee2cdfc30d4683efa68e3db05040d9090c17cee0b8b7e90c891de41c573cfde5787431
-
SSDEEP
3072:nNuzc3XRoS4/cLCUg4zoFtSDlohBijVWRGg7udmZ3z6ovoHiOmv:MdELbbsF2w6VWR0O3vvmiv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c17c9e41619823ce5afc3db33c14b0c1_JaffaCakes118
Files
-
c17c9e41619823ce5afc3db33c14b0c1_JaffaCakes118.sys windows:4 windows x86 arch:x86
c656051230313bf23d08f3484862f43f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExAllocatePoolWithTag
KeBugCheckEx
RtlInitUnicodeString
KeInitializeEvent
KeSetEvent
IoDeleteDevice
IoFreeIrp
ObfDereferenceObject
IoAttachDeviceToDeviceStack
IoDetachDevice
RtlFreeUnicodeString
MmMapLockedPagesSpecifyCache
KeInitializeDpc
ZwOpenKey
RtlQueryRegistryValues
RtlCopyUnicodeString
IoOpenDeviceRegistryKey
IoFreeMdl
ExFreePool
IoQueueWorkItem
IoAllocateMdl
IoAllocateWorkItem
IoBuildDeviceIoControlRequest
IoFreeWorkItem
IoWMIRegistrationControl
KeDelayExecutionThread
ObReferenceObjectByHandle
KeSetTimer
IoSetDeviceInterfaceState
IoCancelIrp
PoSetPowerState
IoRegisterDeviceInterface
ZwSetValueKey
KeReleaseSpinLockFromDpcLevel
MmBuildMdlForNonPagedPool
KeInsertQueueDpc
IoReleaseCancelSpinLock
RtlAnsiStringToUnicodeString
IoWMIWriteEvent
DbgPrint
RtlInitAnsiString
IoAllocateErrorLogEntry
IoBuildSynchronousFsdRequest
IoDeleteSymbolicLink
MmUnmapIoSpace
_vsnwprintf
IoAcquireRemoveLockEx
KeResetEvent
ObfReferenceObject
ZwCreateKey
KeInitializeMutex
IoCreateSymbolicLink
IoReleaseRemoveLockAndWaitEx
_vsnprintf
RtlIntegerToUnicodeString
IoGetAttachedDeviceReference
KeSetTimerEx
ExDeleteNPagedLookasideList
ExInitializeNPagedLookasideList
KeWaitForMultipleObjects
RtlWriteRegistryValue
IoInvalidateDeviceRelations
MmUnlockPages
KeSetPriorityThread
KeRemoveQueueDpc
ZwQuerySystemInformation
ExFreePoolWithTag
Sections
.text Size: 97KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 644B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ