Static task
static1
General
-
Target
152fcf207dfb2a1804eee53cc4390003_JaffaCakes118
-
Size
721KB
-
MD5
152fcf207dfb2a1804eee53cc4390003
-
SHA1
bb5c1d521c6cac0c1e38db17aa1988f64601768a
-
SHA256
dfc3fb916d7bb2bac6ab3d742009795e80094e470eebf995aa5f2d72a68e18e1
-
SHA512
d5c2bb11833cae76c3adf24d3e0a1e4056aaed61ec604b918cf91ef7d16dea417bc1f09ec8005949e7072e032e880f9b7c975cc081df5ed015e750ec0a6fbb6f
-
SSDEEP
12288:QsGG8u7h9DlwAhmvSWkAiwrvkIuFPB7vxHzDYiYV/UT/O0:QsP8g3KvSnQ+hB7vxfmex
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 152fcf207dfb2a1804eee53cc4390003_JaffaCakes118
Files
-
152fcf207dfb2a1804eee53cc4390003_JaffaCakes118.sys windows:4 windows x86 arch:x86
2b73f8938cab6ab63ec4b705ccb59699
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeBugCheckEx
ExAllocatePoolWithTag
RtlInitUnicodeString
KeWaitForSingleObject
KeInitializeEvent
KeSetEvent
IofCallDriver
ExFreePoolWithTag
RtlCompareMemory
IoCreateDevice
ZwQueryValueKey
PoCallDriver
IoFreeIrp
ObfDereferenceObject
PoStartNextPowerIrp
IoAttachDeviceToDeviceStack
IoDetachDevice
IoAllocateIrp
KeInitializeDpc
RtlQueryRegistryValues
RtlCopyUnicodeString
IoOpenDeviceRegistryKey
ExFreePool
IoQueueWorkItem
IoAllocateMdl
IoAllocateWorkItem
IoFreeWorkItem
IoWMIRegistrationControl
KeDelayExecutionThread
ObReferenceObjectByHandle
KeSetTimer
IoSetDeviceInterfaceState
IoCancelIrp
PoSetPowerState
ZwSetValueKey
MmGetSystemRoutineAddress
KeReleaseSpinLockFromDpcLevel
PsCreateSystemThread
KeAcquireSpinLockAtDpcLevel
MmBuildMdlForNonPagedPool
PsTerminateSystemThread
RtlAnsiStringToUnicodeString
DbgPrint
RtlInitAnsiString
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
IoBuildSynchronousFsdRequest
MmUnmapIoSpace
_vsnwprintf
IoInitializeRemoveLockEx
RtlUnicodeStringToAnsiString
KeResetEvent
RtlAppendUnicodeToString
ObfReferenceObject
MmMapIoSpace
IoReleaseRemoveLockEx
RtlAppendUnicodeStringToString
IoCreateSymbolicLink
_vsnprintf
RtlIntegerToUnicodeString
KeSetTimerEx
ExDeleteNPagedLookasideList
ExInitializeNPagedLookasideList
IoAcquireCancelSpinLock
KeWaitForMultipleObjects
IoConnectInterrupt
ZwCreateFile
IoInvalidateDeviceRelations
IoGetDmaAdapter
MmUnlockPages
KeSetPriorityThread
KeRemoveQueueDpc
IoGetDeviceObjectPointer
ZwQuerySystemInformation
Sections
.text Size: 318KB - Virtual size: 317KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 300B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 385KB - Virtual size: 385KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ