ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ
Static task
static1
1 signatures
General
-
Target
090c80b1c36e536e3b2e21b75d55bb43_JaffaCakes118
-
Size
6KB
-
MD5
090c80b1c36e536e3b2e21b75d55bb43
-
SHA1
4c9d8239ecdaf15140475f72de2d6209aa44267f
-
SHA256
e87ac16ec435a37a99532a04cd592f3e6ebdc19165b8c109f26bd0f8c4e29bc7
-
SHA512
d8ad2f867477ec3d1f60186072a6c818243543089f04f5631a20c7b6886759d53a72e6fd534637154ac08987f4dc2dab41af6134e16cce3f039be92ffc0d6fc5
-
SSDEEP
96:xz9cAvCv2GrS4Xu9Fe5S45YFUrVU16SXnBwXdj4WS/i9RF6AKtMzm6tdp:xz9cV2Y1Y2rVUnRwjKoMT63p
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 090c80b1c36e536e3b2e21b75d55bb43_JaffaCakes118
Files
-
090c80b1c36e536e3b2e21b75d55bb43_JaffaCakes118.sys windows:5 windows x86 arch:x86
bb987107c12db4043bce620809ac5191
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ZwTerminateJobObject
ZwAssignProcessToJobObject
ZwCreateJobObject
ObOpenObjectByPointer
_except_handler3
IoCreateFile
RtlInitUnicodeString
IoFreeIrp
KeSetEvent
KeWaitForSingleObject
IofCallDriver
RtlAssert
KeGetCurrentThread
KeInitializeEvent
ObfDereferenceObject
IoAllocateIrp
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
IoFileObjectType
MmUnmapViewOfSection
ZwClose
ZwSetValueKey
wcslen
ZwOpenKey
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
ZwCreateKey
RtlInitAnsiString
IoCreateSymbolicLink
DbgPrint
IoCreateDevice
KeDetachProcess
ZwTerminateProcess
KeAttachProcess
IofCompleteRequest
KeServiceDescriptorTable
ProbeForWrite
ProbeForRead
IoDeleteDevice
IoDeleteSymbolicLink
PsLookupProcessByProcessId
hal
KeGetCurrentIrql
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 419B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 384B - Virtual size: 354B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ