Static task
static1
General
-
Target
f517f83da8b754cec8ce7b8fbb45369c_JaffaCakes118
-
Size
40KB
-
MD5
f517f83da8b754cec8ce7b8fbb45369c
-
SHA1
a5f839d46debf96f196c291e787ccf303b0072f1
-
SHA256
2e9642ab0b7ef97071de53ee3b4b592f1d839ec8a7a2202abe58823f77023991
-
SHA512
6cda2723aa29c1532f8ba19838c4b6c73c0aca57573f6684bc5fc0e5cf0e5bf90e911fb947c535b48fc3477110d0c2ce8e85af61f661d0ae42c7c616d1fb1945
-
SSDEEP
768:3121U2EYcWT6WqC/HcFWKFxOKPN0K8tueqVNn4nybXhHr48L0:3Ea2E9k6WxvEOE0KXeo4cxL48
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f517f83da8b754cec8ce7b8fbb45369c_JaffaCakes118
Files
-
f517f83da8b754cec8ce7b8fbb45369c_JaffaCakes118.sys windows:4 windows x86 arch:x86
0c740f8e1ecf4b6a9f2b091520429941
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwSetValueKey
ObReferenceObjectByHandle
PsSetCreateProcessNotifyRoutine
wcslen
RtlCompareUnicodeString
RtlInitUnicodeString
ZwClose
ZwSetInformationFile
ZwCreateFile
wcscpy
swprintf
KeDelayExecutionThread
KeQuerySystemTime
ObfDereferenceObject
MmIsAddressValid
ZwOpenKey
wcsncpy
wcsrchr
wcscat
_wcsicmp
ZwQueryValueKey
_except_handler3
RtlCopyUnicodeString
_snwprintf
wcschr
ZwCreateKey
strncpy
PsLookupProcessByProcessId
_stricmp
MmGetSystemRoutineAddress
IoDeviceObjectType
_wcsnicmp
IoGetCurrentProcess
PsGetVersion
ExAllocatePoolWithTag
ZwDeleteKey
wcsstr
_wcslwr
IofCompleteRequest
strncmp
ExFreePool
KeTickCount
KeQueryTimeIncrement
_snprintf
PsCreateSystemThread
RtlAnsiStringToUnicodeString
IoRegisterDriverReinitialization
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 65B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ