Static task
static1
General
-
Target
ec13a9a1ef97eab9be048e7a1119d2da_JaffaCakes118
-
Size
40KB
-
MD5
ec13a9a1ef97eab9be048e7a1119d2da
-
SHA1
8720c5d11196f20d50064753d1626b908e6aa773
-
SHA256
dd43ba98f6cc5a9c93320f617434281060cebed96e9800401f390c130139b21b
-
SHA512
9b77c8932276b95001ec91af4770a927c66978639004716bb707aff408e23dec074a5f06497f0282ce5cf37dd94e9095b6da76b371e4aa27c0fe6a26330c7536
-
SSDEEP
768:lKCZu3hHK624F1amNgHMhqgJiaPJJXIZrpwG5sa8Fgl1pavZU:4RHK6pNwMhqgUaPLXIZCymFEpQZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ec13a9a1ef97eab9be048e7a1119d2da_JaffaCakes118
Files
-
ec13a9a1ef97eab9be048e7a1119d2da_JaffaCakes118.sys windows:4 windows x86 arch:x86
e0063fe8a40fec1fe8950df7923c08fb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwDeleteKey
swprintf
strncmp
_snwprintf
ExAllocatePoolWithTag
RtlInitUnicodeString
ZwSetValueKey
ZwQueryValueKey
ZwOpenKey
_except_handler3
_wcsnicmp
wcslen
wcsncpy
wcschr
IofCompleteRequest
MmIsAddressValid
RtlCopyUnicodeString
IoDeviceObjectType
IoGetCurrentProcess
ZwCreateKey
wcsrchr
PsGetVersion
KeTickCount
KeQueryTimeIncrement
_stricmp
ZwCreateFile
RtlCompareUnicodeString
wcscat
wcscpy
_wcsicmp
ObReferenceObjectByHandle
ExFreePool
ObfDereferenceObject
RtlAnsiStringToUnicodeString
strncpy
wcsstr
_wcslwr
_snprintf
KeDelayExecutionThread
KeQuerySystemTime
PsLookupProcessByProcessId
IoRegisterDriverReinitialization
ZwSetInformationFile
PsCreateSystemThread
PsSetCreateProcessNotifyRoutine
MmGetSystemRoutineAddress
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 74B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ