Static task
static1
General
-
Target
0233b61b6ed3476e12b353a30bb75103_JaffaCakes118
-
Size
40KB
-
MD5
0233b61b6ed3476e12b353a30bb75103
-
SHA1
500bc9b14420abe8840d8a2727d2d2e19aa27da8
-
SHA256
c9a006d14faa29608e4bcb64064f8c4072bba015fac28539369c3f61964ce2e3
-
SHA512
63a34aab1a262a2563e70cd7b36f1c61384f63aa57149de0f5bd5a1d24667e54f01f82bfa395a5bb01e8db0e2e9b767990eba60dc7fdae3f2c9c7bb57360d22c
-
SSDEEP
768:nStwOcpFLz0EwUTqhQZ1GEA5vHAYISCBIR3QDm+IAKF7/XyR2VE:StOvLz0EwUTqhQZQEAhdCsgDfIAjz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0233b61b6ed3476e12b353a30bb75103_JaffaCakes118
Files
-
0233b61b6ed3476e12b353a30bb75103_JaffaCakes118.sys windows:4 windows x86 arch:x86
aa8bdaae85cab305a6c41e0bd0a6ce51
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_snwprintf
ExAllocatePoolWithTag
RtlInitUnicodeString
RtlCompareUnicodeString
RtlAnsiStringToUnicodeString
ZwClose
ZwSetInformationFile
ZwCreateFile
wcslen
wcscpy
swprintf
_wcsicmp
_wcsnicmp
KeTickCount
KeQueryTimeIncrement
_stricmp
ZwSetValueKey
ZwCreateKey
ObReferenceObjectByHandle
ObfDereferenceObject
MmIsAddressValid
ZwOpenKey
wcsncpy
wcsrchr
KeDelayExecutionThread
KeQuerySystemTime
wcsstr
_wcslwr
ZwQueryValueKey
IoRegisterDriverReinitialization
ZwDeleteKey
wcscat
_except_handler3
PsGetVersion
strncmp
IoGetCurrentProcess
strncpy
PsLookupProcessByProcessId
wcschr
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlCopyUnicodeString
PsSetCreateProcessNotifyRoutine
MmGetSystemRoutineAddress
IofCompleteRequest
PsCreateSystemThread
ExFreePool
IoDeviceObjectType
_snprintf
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 128B - Virtual size: 97B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ