Static task
static1
General
-
Target
0183f25e267bdbdf154b2ae1cda8a3a2_JaffaCakes118
-
Size
13KB
-
MD5
0183f25e267bdbdf154b2ae1cda8a3a2
-
SHA1
1bf45df1d6d44d88fb725ca1a867ebb0ee1f0f52
-
SHA256
b2682f3d5a65cd61e65055fd0719b096c9b8ac875e0a2f53744e1de3ed85cd0e
-
SHA512
b55b698c611e4f10ff8df5855cb23b66313d2ef36e2e351146ff3bd65b1c4f3d410bf8f1c9f2a655adc3bcd9ff3734d731e816644f73637cd3a43e8df7aa5e97
-
SSDEEP
384:Xjnz16iCaLOg9hMbpIUTXRoL9TfWty/+T:Tnz16FUO7pIEhc7kh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0183f25e267bdbdf154b2ae1cda8a3a2_JaffaCakes118
Files
-
0183f25e267bdbdf154b2ae1cda8a3a2_JaffaCakes118.sys windows:4 windows x86 arch:x86
8cf5fd61dbe2d8f155e879326bfc8aa1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
RtlInitUnicodeString
isspace
strstr
islower
PsTerminateSystemThread
KeDelayExecutionThread
PsCreateSystemThread
swprintf
_stricmp
strncpy
PsLookupProcessByProcessId
ExAllocatePoolWithTag
KeInitializeTimer
atoi
strrchr
IofCompleteRequest
PsSetCreateProcessNotifyRoutine
tolower
srand
isdigit
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsGetVersion
atol
DbgPrint
isupper
isxdigit
toupper
RtlAnsiStringToUnicodeString
_snprintf
ExFreePool
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
MmIsAddressValid
ZwCreateKey
wcslen
wcscat
wcscpy
isprint
strchr
_wcslwr
wcsncpy
ZwUnmapViewOfSection
ZwCreateFile
IoRegisterDriverReinitialization
strncmp
IoGetCurrentProcess
_wcsnicmp
ZwSetValueKey
ZwOpenKey
ZwEnumerateKey
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 800B - Virtual size: 796B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ