Static task
static1
General
-
Target
ffec1fbd6ee00aa078ac64e46fa07ba9_JaffaCakes118
-
Size
40KB
-
MD5
ffec1fbd6ee00aa078ac64e46fa07ba9
-
SHA1
161038cf36522ed1f47a47cdc9f9290abb6339c7
-
SHA256
6e06b3c1c3497b1b2338453100d5dd25d9849617ee06fa333aba96ecb907afec
-
SHA512
d79b60927eb995758201fdbb7a9510506956b54707b0bc504f51b5b6bab92b005cbd068c29b3334874af143f3d07c88218306f49e1cce7f0159aa1f5f846bca6
-
SSDEEP
768:FR4nyyJt2EjzYPTGUm00pX8AvVvHl7QozMaOwsroSx7WftVdWAqomtnM:FFyJpjImxpXLVv1jInoLtaNM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ffec1fbd6ee00aa078ac64e46fa07ba9_JaffaCakes118
Files
-
ffec1fbd6ee00aa078ac64e46fa07ba9_JaffaCakes118.sys windows:4 windows x86 arch:x86
c7d2f9f5823758422a7b66ddb56bca51
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwOpenKey
RtlInitUnicodeString
_wcsnicmp
wcslen
ObfDereferenceObject
ZwQueryValueKey
swprintf
MmIsAddressValid
IoDeviceObjectType
wcscat
wcscpy
_wcsicmp
_except_handler3
KeTickCount
KeQueryTimeIncrement
_stricmp
wcsncpy
IoGetCurrentProcess
PsGetVersion
KeQuerySystemTime
wcsstr
_wcslwr
ZwSetValueKey
ZwCreateKey
IofCompleteRequest
RtlAnsiStringToUnicodeString
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
wcsrchr
MmGetSystemRoutineAddress
PsSetCreateProcessNotifyRoutine
RtlCompareUnicodeString
ZwSetInformationFile
ZwCreateFile
PsCreateSystemThread
ExFreePool
_snprintf
ExAllocatePoolWithTag
ObReferenceObjectByHandle
ZwDeleteKey
IoRegisterDriverReinitialization
RtlCopyUnicodeString
strncpy
_snwprintf
strncmp
PsLookupProcessByProcessId
wcschr
KeDelayExecutionThread
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEALL Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDATA Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 64B - Virtual size: 46B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ