Static task
static1
General
-
Target
0ac29fe0a187ea78c0842549ef4c1976_JaffaCakes118
-
Size
41KB
-
MD5
0ac29fe0a187ea78c0842549ef4c1976
-
SHA1
75f831fc0afb990daf4fe4a43a6cc3993d3800b0
-
SHA256
413b164792a17996ad6d1838b73fd863cb9adf7f30aa1b4c28a5637134dc3cab
-
SHA512
a15cdf20f73298a94355d45b6beb0d333f9329384591dd04a667ac6f2f3f75c1b29d1ed857addd7b335b5cd78123f1d4b3de538de3c2851c8129fdb3991f8260
-
SSDEEP
768:KC7a4zp/6ipKsnXrb8vyb4QIdJeG+5hVeH2jXjJA3jWiyzyfQfYxy:KC5tnpd30ybIeGqhVekja6P+xy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ac29fe0a187ea78c0842549ef4c1976_JaffaCakes118
Files
-
0ac29fe0a187ea78c0842549ef4c1976_JaffaCakes118.sys windows:4 windows x86 arch:x86
c5d375f1c7d997b2d0ac122f10c0f850
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
strncpy
PsLookupProcessByProcessId
_stricmp
ExFreePool
ExAllocatePoolWithTag
ZwClose
ObfDereferenceObject
ZwSetValueKey
wcsstr
_wcslwr
_snwprintf
RtlInitUnicodeString
ZwCreateKey
swprintf
MmGetSystemRoutineAddress
ZwQueryValueKey
ZwOpenKey
_except_handler3
_wcsnicmp
wcslen
wcscat
wcscpy
_wcsicmp
strncmp
MmIsAddressValid
ObReferenceObjectByHandle
wcsncpy
wcsrchr
PsSetCreateProcessNotifyRoutine
RtlCompareUnicodeString
KeQuerySystemTime
IoDeviceObjectType
PsGetVersion
KeTickCount
KeQueryTimeIncrement
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
_snprintf
IofCompleteRequest
RtlAnsiStringToUnicodeString
ZwDeleteKey
ZwCreateFile
wcschr
IoGetCurrentProcess
RtlCopyUnicodeString
IoRegisterDriverReinitialization
KeDelayExecutionThread
ZwSetInformationFile
PsCreateSystemThread
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEALL Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDATA Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 96B - Virtual size: 82B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ