Static task
static1
General
-
Target
08ab0518b0319f18f048ce33cb0ea073_JaffaCakes118
-
Size
40KB
-
MD5
08ab0518b0319f18f048ce33cb0ea073
-
SHA1
026571e0603af5d29d5f17ded2d569bcfa61275c
-
SHA256
f7a5e3fee93167749896319996a6990cdd7d9ad1c102e7109e8df84f97716022
-
SHA512
e6a1450d30d40f13649afeb2c36b83f9ef6f568a60962e78f0ad0574eec1a69a02adf13ecc23920a12937ffe2da86b552eaa09b85888d8419012cbc2ff1adc91
-
SSDEEP
768:hwrwpQ5j4YjPlaXXt77/EL2fAC01Z2czhI0zAP4x+iHyR0ZziZ2JKbvDl:eiQitHeL2fO1ZZ/zn+M68jI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 08ab0518b0319f18f048ce33cb0ea073_JaffaCakes118
Files
-
08ab0518b0319f18f048ce33cb0ea073_JaffaCakes118.sys windows:4 windows x86 arch:x86
91948d576122c4e4dbfdaf0ccc2cf558
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
ObReferenceObjectByHandle
_wcsicmp
wcsncpy
wcslen
wcsrchr
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
strncpy
PsLookupProcessByProcessId
_stricmp
swprintf
wcscat
wcscpy
PsGetVersion
ObfDereferenceObject
MmIsAddressValid
wcsstr
_wcslwr
ZwSetValueKey
ZwCreateKey
ZwDeleteKey
KeQuerySystemTime
_snwprintf
ExAllocatePoolWithTag
RtlAnsiStringToUnicodeString
_wcsnicmp
IoRegisterDriverReinitialization
MmGetSystemRoutineAddress
_except_handler3
ZwCreateFile
wcschr
PsSetCreateProcessNotifyRoutine
strncmp
ExFreePool
_snprintf
KeDelayExecutionThread
IoGetCurrentProcess
IoDeviceObjectType
ZwSetInformationFile
KeTickCount
KeQueryTimeIncrement
RtlCompareUnicodeString
RtlCopyUnicodeString
PsCreateSystemThread
IofCompleteRequest
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEALL Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDATA Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 96B - Virtual size: 74B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ