Static task
static1
General
-
Target
08769b1443a54335ac24226325e4fd24_JaffaCakes118
-
Size
393KB
-
MD5
08769b1443a54335ac24226325e4fd24
-
SHA1
49739866f6533b19fba9289265223a903aae83a2
-
SHA256
86fbb4cd4fbfa6536e0cf5c9024108ba5de601cdc13529536d4d01c069358435
-
SHA512
3ce525859d1f14c3d3d07fc90d79950f6e77441c86c46e4f202f5ce069fa54830490916d0bf3ba4830d0c92fbb1ca743c6f47a154a4da668c16e6ca79d017f5e
-
SSDEEP
6144:4R5vDGTipQp/mKaL/K9m99B0mw0h9u4bBmnULd07AKrqzkK31CBs5lU/sh31fm8/:ll/U/KwPBdFVt6IF31CBiG/sBm8TL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 08769b1443a54335ac24226325e4fd24_JaffaCakes118
Files
-
08769b1443a54335ac24226325e4fd24_JaffaCakes118.sys windows:6 windows x86 arch:x86
7933588655fc220320e82e2b9225dcdd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitUnicodeString
_allmul
_alldiv
ExRaiseStatus
ExAllocatePoolWithTagPriority
ExFreePoolWithTag
ZwQueryInformationProcess
RtlCompareUnicodeString
KeReleaseMutex
KeWaitForSingleObject
ZwEnumerateKey
ZwDeleteKey
ZwOpenKey
wcsncat
memset
IoDeleteDevice
KeDetachProcess
KeAttachProcess
PsLookupProcessByProcessId
ExAllocatePoolWithTag
KeInitializeMutex
memcpy
MmGetSystemRoutineAddress
RtlCopyUnicodeString
ZwOpenProcess
ZwQueryValueKey
ZwSetValueKey
ZwLoadDriver
ZwCreateKey
ZwReadFile
ZwCreateFile
ZwSetInformationFile
ZwWriteFile
ZwQueryInformationFile
ZwQueryVolumeInformationFile
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
swprintf
SeCreateClientSecurity
KeGetCurrentThread
KeQuerySystemTime
sprintf
RtlImageDirectoryEntryToData
RtlImageNtHeader
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
KeTickCount
KeBugCheckEx
ObfDereferenceObject
ZwClose
RtlUnwind
hal
KeGetCurrentIrql
Sections
.text Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 337KB - Virtual size: 337KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 768B - Virtual size: 696B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ