Static task
static1
General
-
Target
01d4be02720105c22ff1e96fed420644_JaffaCakes118
-
Size
13KB
-
MD5
01d4be02720105c22ff1e96fed420644
-
SHA1
63fa68d47b2d616be086d55a91436006b64ff81e
-
SHA256
0022830cf6bd20a1ef400dd30a4dfea655530275380a7f3f7b70169ec2b8bea5
-
SHA512
09e006cbfaf48d371c491ca3fc58bf2ecf0c8e468e76a3f273633292fe4259aa445ecb2c067b0280d10822cfe2b786e1eb09dfc4f1874cc7af43523194550fc8
-
SSDEEP
192:hXVsr8a+wdjd4tNHPHRMsfaVpv4Tpo/H5bBWZ8NWZwB:FVsr8dnPHe8W14TpydBWZ8NW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 01d4be02720105c22ff1e96fed420644_JaffaCakes118
Files
-
01d4be02720105c22ff1e96fed420644_JaffaCakes118.sys windows:5 windows x86 arch:x86
c640337827196175a5f46376fa8ea20e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwCreateFile
ZwClose
ZwQueryValueKey
ZwSetValueKey
ZwCreateKey
KeServiceDescriptorTable
RtlAnsiStringToUnicodeString
RtlFreeAnsiString
IoDeleteDevice
PsSetCreateProcessNotifyRoutine
PsCreateSystemThread
swprintf
IoCreateSymbolicLink
IoCreateDevice
wcscat
_strlwr
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
wcsrchr
_wcslwr
IoRegisterDriverReinitialization
RtlCompareMemory
IofCompleteRequest
ZwEnumerateKey
ZwOpenKey
InterlockedIncrement
ObfDereferenceObject
KeWaitForSingleObject
ObReferenceObjectByHandle
sprintf
ExAllocatePoolWithTag
_stricmp
strncpy
PsLookupProcessByProcessId
IoGetCurrentProcess
_except_handler3
PsTerminateSystemThread
ExFreePool
RtlFreeUnicodeString
RtlInitAnsiString
KeDelayExecutionThread
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 448B - Virtual size: 420B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 482B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ