Static task
static1
General
-
Target
ec2ba604d05223c9261d17ac489da665_JaffaCakes118
-
Size
24KB
-
MD5
ec2ba604d05223c9261d17ac489da665
-
SHA1
4eaa023f40181388b7964e84e0f7f3a8a19fba87
-
SHA256
08fb55472434a6429ea06d280b5959c6bd03901ba0d4320314509fbb6a6089e4
-
SHA512
a3b0ec2048f46a0aba9a907e4e71ce0cf22b36e007d649174c12b2a94e89bfa20c731b9c81fceae0d821b348b774fa37b83e2779ea935764b602a75ce3c59bb4
-
SSDEEP
384:NxaHMt1QCEatdBWWZ68Nfb35E62kmV7HBUOZ492ggcOD56:NxaHxmriyaz76OZ492g4D
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ec2ba604d05223c9261d17ac489da665_JaffaCakes118
Files
-
ec2ba604d05223c9261d17ac489da665_JaffaCakes118.sys windows:5 windows x86 arch:x86
5d5f9c5941b6a8ef8ced6c159d8fcff3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
MmIsAddressValid
strncmp
IoGetCurrentProcess
_wcsnicmp
wcslen
ZwClose
ZwUnmapViewOfSection
RtlInitUnicodeString
PsTerminateSystemThread
KeDelayExecutionThread
PsCreateSystemThread
wcscat
wcscpy
_stricmp
strncpy
PsLookupProcessByProcessId
ExAllocatePoolWithTag
KeInitializeTimer
IofCompleteRequest
PsGetVersion
_wcslwr
wcsncpy
swprintf
ZwCreateKey
RtlAnsiStringToUnicodeString
ZwCreateFile
IoRegisterDriverReinitialization
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
_snprintf
ExFreePool
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
ZwSetValueKey
ZwOpenKey
ZwEnumerateKey
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 960B - Virtual size: 958B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 608B - Virtual size: 604B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ