Static task
static1
General
-
Target
f66452baf06c960f74f72e8cec5b36c5_JaffaCakes118
-
Size
15KB
-
MD5
f66452baf06c960f74f72e8cec5b36c5
-
SHA1
e0a9c6b57e970a025bd48d8948d6d3ef770b9dd3
-
SHA256
4410cd84495e1e6650d5b8062117d99dede4de9a51802a2b679d8d7bda88d750
-
SHA512
9ff61fe57ccabd9ec04a2b8d1dd30d6573f90178dff07dd6bfee28be26320534fe07e3bef1596deaa8b17626991e6bb51bb22228b0f4e61f890cfded85018f22
-
SSDEEP
192:nwFn2GIjtPMi0dl8DPDtcBc/jsmxQaP8FfFKQJdEerH7JB3UKvPJa+oSz:nwF5mL0P8bDtcBqKfFRJGeZNnPpz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f66452baf06c960f74f72e8cec5b36c5_JaffaCakes118
Files
-
f66452baf06c960f74f72e8cec5b36c5_JaffaCakes118.sys windows:4 windows x86 arch:x86
308b4551244f2687791fce6838e06366
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
_snprintf
ZwCreateFile
RtlInitUnicodeString
_snwprintf
PsTerminateSystemThread
KeDelayExecutionThread
_allmul
IoDeleteDevice
IoDeleteSymbolicLink
ExFreePoolWithTag
IofCompleteRequest
MmMapLockedPagesSpecifyCache
ExAllocatePoolWithTag
PsCreateSystemThread
IoCreateSymbolicLink
IoCreateDevice
strchr
atoi
wcstombs
ZwWaitForSingleObject
ZwEnumerateKey
ZwQueryValueKey
wcscat
wcslen
ZwOpenKey
wcscpy
KeServiceDescriptorTable
ZwSetValueKey
MmIsAddressValid
KeAddSystemServiceTable
wcscmp
ZwQuerySystemInformation
ZwFreeVirtualMemory
KeUserModeCallback
ZwAllocateVirtualMemory
ZwQueryInformationProcess
KeDetachProcess
KeAttachProcess
PsLookupProcessByProcessId
KeClearEvent
KeSetEvent
PsGetCurrentProcessId
KeWaitForSingleObject
NtBuildNumber
KeInitializeEvent
ZwDeleteFile
ZwWriteFile
strstr
ObfDereferenceObject
ObReferenceObjectByHandle
IofCallDriver
IoBuildDeviceIoControlRequest
IoGetRelatedDeviceObject
IoFreeMdl
MmProbeAndLockPages
IoFreeIrp
IoAllocateMdl
_except_handler3
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 416B - Virtual size: 412B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 576B - Virtual size: 568B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 960B - Virtual size: 942B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ