Static task
static1
General
-
Target
df23c4d38c93a4bb93bd281e6b0a73ee_JaffaCakes118
-
Size
741KB
-
MD5
df23c4d38c93a4bb93bd281e6b0a73ee
-
SHA1
07084a06dd861d8dc07aecaf81dd870d26bf50ff
-
SHA256
99050f0d59952d11ab8f8d904fa39eda8f068b1a9957421ce4eeace4266b02ba
-
SHA512
c5c2f1d792e55df5cd66845e70fe285f0dbf065b913abc31e0ed596fd922ee28856bc70f0325567542827acf9528533adf542af070ba6c9b753fcbeb799b1e89
-
SSDEEP
12288:u7jtiAMBVgnXtsC1vqd6EYyaABZoc6yruPbwRceCMV5PRY7SigPsEV:u7RiAM/gXtsnRYyaqupyrKmV5PRYuigh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df23c4d38c93a4bb93bd281e6b0a73ee_JaffaCakes118
Files
-
df23c4d38c93a4bb93bd281e6b0a73ee_JaffaCakes118.sys windows:4 windows x86 arch:x86
6bc55a7e3b33651357f0aed60e8b9c3d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeBugCheckEx
ExAllocatePoolWithTag
KeInitializeEvent
ZwClose
IofCompleteRequest
RtlCompareMemory
IoCreateDevice
IoAllocateIrp
KeInitializeDpc
IoOpenDeviceRegistryKey
IoFreeMdl
ExFreePool
IoQueueWorkItem
IoAllocateMdl
KeInitializeTimer
ObReferenceObjectByHandle
KeSetTimer
ZwSetValueKey
MmGetSystemRoutineAddress
IoGetDeviceProperty
IoReleaseCancelSpinLock
RtlAnsiStringToUnicodeString
IoWriteErrorLogEntry
IoDeleteSymbolicLink
MmUnmapIoSpace
_vsnwprintf
KeResetEvent
ObfReferenceObject
MmMapIoSpace
IoReleaseRemoveLockEx
ZwCreateKey
KeQueryTimeIncrement
IoReleaseRemoveLockAndWaitEx
RtlIntegerToUnicodeString
ExInitializeNPagedLookasideList
IoAcquireCancelSpinLock
ZwCreateFile
MmUnlockPages
KeRemoveQueueDpc
ZwQuerySystemInformation
ExFreePoolWithTag
RtlInitUnicodeString
_snprintf
Sections
.text Size: 334KB - Virtual size: 334KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 387KB - Virtual size: 387KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ