_CopyVMemory@4
_MoveVMemory@4
Static task
static1
1 signatures
General
-
Target
3935e2f0d334def493a7c1c10789d177_JaffaCakes118
-
Size
30KB
-
MD5
3935e2f0d334def493a7c1c10789d177
-
SHA1
0c58fa846b55a524abd0db61f4d1ec3e0fc2c09e
-
SHA256
db2249358b3f04807bc99936236b2ee37bc70718cef6bf7c0b3e5fc8bf0e9adf
-
SHA512
08b638f4dc79bd01380022b603edfb31c93e0a2e1d256c72f48124e750056260dab9b13cf6f3d199e5e81787e3a26e4234e556349a1e5d6bc84b42ca2c5efc25
-
SSDEEP
384:cS3F6GRhqO87cNoskc5q7Vth+GRmgo3lWc5gnN+1B5wJYU4oUMb5:7V6GRhV8cA7t+aRfc5gn94oUc
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3935e2f0d334def493a7c1c10789d177_JaffaCakes118
Files
-
3935e2f0d334def493a7c1c10789d177_JaffaCakes118.sys windows:5 windows x86 arch:x86
1c98bb20a83786acc79d09c3a9e5cabc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExReinitializeResourceLite
ExAcquireResourceExclusiveLite
ExFreePoolWithTag
ExAllocatePool
ExAcquireResourceSharedLite
ExInitializeResourceLite
ExAcquireSharedStarveExclusive
ZwOpenEvent
KeClearEvent
ObGetObjectSecurity
ZwCreateEvent
ExUuidCreate
VerSetConditionMask
ZwQuerySymbolicLinkObject
KeSetEvent
KeInitializeEvent
ZwCreateDirectoryObject
ZwPowerInformation
ZwDeleteValueKey
RtlInitString
RtlCompareString
ZwOpenSymbolicLinkObject
ZwSetInformationFile
RtlUpperChar
ZwClose
KeWaitForSingleObject
IoAllocateIrp
ZwCreateSection
wcsncmp
ZwQueryInformationFile
ZwDeleteKey
ZwOpenSection
ObReferenceObjectByPointer
memset
Exports
Exports
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.code Size: 512B - Virtual size: 386B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ecode Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ