Static task
static1
General
-
Target
056ce3114a463d68bfe18593f735b517_JaffaCakes118
-
Size
41KB
-
MD5
056ce3114a463d68bfe18593f735b517
-
SHA1
3ed0930235b65e6b41389bf211db7356f08f650a
-
SHA256
a539040459095dc563cef62bdea1e0a397f59ac0f32f99cf74cf611481e25456
-
SHA512
a1d158423e6d0860498c59a39f4c643e5a0684e58b1aa12d4e76ec1a942f95594e6cea0791f30343fbd9123b6a00379d6c26195ffed50d8f407193c770460bae
-
SSDEEP
768:8zIAg1SJK4dXseeHnu9i61nD6dIJLXWGfrLoe1gC/UqZkkQtUWNXQFH0mw4EiVPT:qfg1Sdpseau9B1D6dItXWOLoe1ZTQtUS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 056ce3114a463d68bfe18593f735b517_JaffaCakes118
Files
-
056ce3114a463d68bfe18593f735b517_JaffaCakes118.sys windows:4 windows x86 arch:x86
4e7f5f0017530dd5bb05ba8a313c3ec1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_wcsicmp
IoRegisterDriverReinitialization
_snwprintf
wcsncpy
wcslen
wcschr
ZwSetValueKey
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
RtlInitUnicodeString
swprintf
wcsstr
_wcslwr
ZwCreateKey
wcsrchr
MmIsAddressValid
IofCompleteRequest
KeTickCount
KeQueryTimeIncrement
_stricmp
_wcsnicmp
ZwSetInformationFile
ZwCreateFile
wcscpy
KeDelayExecutionThread
KeQuerySystemTime
ZwQueryValueKey
wcscat
_except_handler3
IoDeviceObjectType
ZwDeleteKey
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
strncmp
IoGetCurrentProcess
ExFreePool
ExAllocatePoolWithTag
strncpy
PsLookupProcessByProcessId
RtlCompareUnicodeString
_snprintf
PsGetVersion
RtlAnsiStringToUnicodeString
PsCreateSystemThread
PsSetCreateProcessNotifyRoutine
RtlCopyUnicodeString
MmGetSystemRoutineAddress
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 58B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEALL Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDATA Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ