Static task
static1
General
-
Target
05f5b615581e6df3c6fa017ba5202810_JaffaCakes118
-
Size
31KB
-
MD5
05f5b615581e6df3c6fa017ba5202810
-
SHA1
f477b2bd3b621462a39ff4adeb150c4fe5c3488b
-
SHA256
671d2195c4be2e6bbfdbf8a208201c89399dddc5e0683625f92559771a4edd6d
-
SHA512
7068cdff11eab42e88b0d15efd50638258fa71b1d33133dafe95ff33a6e13f4adf608006a69364f27dcc21639ba0471a29388e51656998b1c682b753316daef3
-
SSDEEP
768:U1q7uwa5VxJo42L1uCQ1gCac1N6Cbv0FAlUWBR7afYCGe/ojsjvA5RF2ueIzktVB:fVa5VEWCuBac1N6kMFAlUWBR7afY/e/B
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 05f5b615581e6df3c6fa017ba5202810_JaffaCakes118
Files
-
05f5b615581e6df3c6fa017ba5202810_JaffaCakes118.sys windows:4 windows x86 arch:x86
c1d5b1871c83386264e3d9544f2912de
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
atol
ZwClose
swprintf
strrchr
RtlAnsiStringToUnicodeString
strstr
isprint
atoi
isxdigit
islower
strchr
tolower
KeDelayExecutionThread
ZwCreateKey
wcslen
RtlInitUnicodeString
wcscat
wcscpy
srand
isupper
isspace
MmIsAddressValid
ZwUnmapViewOfSection
ZwCreateFile
IoRegisterDriverReinitialization
isdigit
PsTerminateSystemThread
PsCreateSystemThread
_stricmp
strncpy
PsLookupProcessByProcessId
ExAllocatePoolWithTag
KeInitializeTimer
IofCompleteRequest
strncmp
IoGetCurrentProcess
_wcsnicmp
toupper
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsGetVersion
_snprintf
ExFreePool
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
ZwEnumerateKey
ZwSetValueKey
ZwOpenKey
_wcslwr
wcsncpy
Sections
.text Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ