Static task
static1
General
-
Target
ebe2cac61c71644e8498b5efc0d4ffa9_JaffaCakes118
-
Size
40KB
-
MD5
ebe2cac61c71644e8498b5efc0d4ffa9
-
SHA1
77864f77244200fb35ab24e8bb0a4415b73ab47e
-
SHA256
e8b167ea69fe6358dca99a9e1b323f0c60745833c897b0367081f031fbcfbfcb
-
SHA512
771643619a743685e89480cca7213632df06408fea1ddb159b90a69ff37296b60023e378967f981c00066996280237bb0efdcbf9e51c9ccb82c453529f560ee9
-
SSDEEP
768:FH026QjOrX37R7MeJvkIlzObAsoXmSM6yb7wTao1/SQJII0BgZn4h+6:FH0/NX9MrIZOUsoy6y/s/h/4g5E
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ebe2cac61c71644e8498b5efc0d4ffa9_JaffaCakes118
Files
-
ebe2cac61c71644e8498b5efc0d4ffa9_JaffaCakes118.sys windows:4 windows x86 arch:x86
8621c30df123d04a60bca59176e3c680
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IofCompleteRequest
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ZwClose
ZwDeleteKey
ZwOpenKey
ZwSetValueKey
strncpy
PsLookupProcessByProcessId
_stricmp
ZwQueryValueKey
RtlCompareUnicodeString
wcslen
swprintf
wcscat
wcscpy
KeTickCount
KeQueryTimeIncrement
MmGetSystemRoutineAddress
RtlAnsiStringToUnicodeString
PsSetCreateProcessNotifyRoutine
ObfDereferenceObject
MmIsAddressValid
ObReferenceObjectByHandle
wcsncpy
wcsrchr
_wcsicmp
IoGetCurrentProcess
ZwCreateFile
wcsstr
_wcslwr
_except_handler3
_snwprintf
ExAllocatePoolWithTag
wcschr
PsGetVersion
ZwCreateKey
_wcsnicmp
ExFreePool
_snprintf
KeDelayExecutionThread
KeQuerySystemTime
RtlCopyUnicodeString
IoDeviceObjectType
strncmp
IoRegisterDriverReinitialization
ZwSetInformationFile
PsCreateSystemThread
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 64B - Virtual size: 58B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ