Static task
static1
General
-
Target
ec3afc573aac9e6e0d3447c393c23a36_JaffaCakes118
-
Size
40KB
-
MD5
ec3afc573aac9e6e0d3447c393c23a36
-
SHA1
1cc7d06befd4cd50a514ac3c288b0c4fc8356399
-
SHA256
e42f080e92964c61a70866912afcc1b9d2cebcaff6ebd6f9a8ba107214278a23
-
SHA512
4e4757c6f9f0e3d6c6140af6de1409e8898b96be7cb0cefb8479796e3293d8bec4d66ddaf5f71e5c6744b5ea0131c12f6196c943ee54c8cbafed93adc097a3a2
-
SSDEEP
768:e5YW009L/MJG3Eg9sQoCaq0335FFzQpyJzlzqFk+A0PmnZzWauV0siBC:e2W6GL9tBaq0335FEyJRzIk+A1nZVuVJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ec3afc573aac9e6e0d3447c393c23a36_JaffaCakes118
Files
-
ec3afc573aac9e6e0d3447c393c23a36_JaffaCakes118.sys windows:4 windows x86 arch:x86
95e96528177ea277ccdd5eaceb68127f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_wcsicmp
wcsncpy
wcslen
wcsrchr
RtlInitUnicodeString
KeTickCount
KeQueryTimeIncrement
_stricmp
ZwCreateKey
swprintf
RtlAnsiStringToUnicodeString
ZwClose
ZwSetValueKey
ZwQueryValueKey
ZwOpenKey
_except_handler3
KeDelayExecutionThread
KeQuerySystemTime
strncmp
_wcsnicmp
ObfDereferenceObject
wcscat
wcscpy
RtlCopyUnicodeString
MmIsAddressValid
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ObReferenceObjectByHandle
IoGetCurrentProcess
PsGetVersion
PsCreateSystemThread
IoDeviceObjectType
RtlCompareUnicodeString
wcsstr
_wcslwr
IoRegisterDriverReinitialization
IofCompleteRequest
_snwprintf
wcschr
ZwDeleteKey
PsSetCreateProcessNotifyRoutine
strncpy
PsLookupProcessByProcessId
ZwSetInformationFile
ZwCreateFile
MmGetSystemRoutineAddress
ExFreePool
ExAllocatePoolWithTag
_snprintf
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEALL Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 64B - Virtual size: 49B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ