Static task
static1
General
-
Target
ec0ea95961004e3357c444b36d4017b1_JaffaCakes118
-
Size
81KB
-
MD5
ec0ea95961004e3357c444b36d4017b1
-
SHA1
07460afd144fe9f625600424ace7eca58fbeabb2
-
SHA256
d77740a5925122935554c71bed55e90229787a5a3db1b04a77dba2fe2c0df86a
-
SHA512
2a088221ded7bb784f0909b7acfdae9a3d8a18a6a0524edcd9bef0b1c579bd34220bf1066c76327421bbd4287a21da43c295eb55d198556522ee8518ed87d12b
-
SSDEEP
1536:k8c75YyT3jjTXracoT1H5T/7ybe8Sqvbl2rV9mQJQD:lc75LLTXrackZuZSqvQ4qQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ec0ea95961004e3357c444b36d4017b1_JaffaCakes118
Files
-
ec0ea95961004e3357c444b36d4017b1_JaffaCakes118.sys windows:4 windows x86 arch:x86
14e157f9cdcc202d0b31cd11e7d6ba4c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
hal
KeAcquireQueuedSpinLock
KeAcquireInStackQueuedSpinLock
KfLowerIrql
KfRaiseIrql
KeGetCurrentIrql
KeReleaseQueuedSpinLock
KeReleaseInStackQueuedSpinLock
ntoskrnl.exe
RtlEqualUnicodeString
ExAllocatePoolWithQuota
MmUnmapLockedPages
READ_REGISTER_USHORT
IoCancelIrp
ExQueueWorkItem
FsRtlMdlReadComplete
KeDetachProcess
FsRtlMdlRead
KeAttachProcess
IoGetRequestorProcess
FsRtlCopyRead
IoQueryFileInformation
_aullrem
PsGetCurrentProcessId
ObFindHandleForObject
ObCloseHandle
ObOpenObjectByName
IoThreadToProcess
KeTickCount
KeInitializeApc
KeInsertQueueApc
KeAcquireInStackQueuedSpinLockAtDpcLevel
KeReleaseInStackQueuedSpinLockFromDpcLevel
ObfReferenceObject
IoAcquireCancelSpinLock
IoReleaseCancelSpinLock
memmove
ExFreePoolWithTag
IofCompleteRequest
IoFreeMdl
ObfDereferenceObject
ObReferenceObjectByHandle
ExGetPreviousMode
InterlockedPushEntrySList
tdi.sys
TdiReturnChainedReceives
TdiMatchPdoWithChainedReceiveContext
TdiDeregisterPnPHandlers
TdiRegisterPnPHandlers
TdiCopyMdlToBuffer
TdiCopyBufferToMdl
Sections
.text Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 186B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.PAGE Size: 256B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE