Static task
static1
General
-
Target
0bfeac6f3429ba3a48a7940dfe32c133_JaffaCakes118
-
Size
40KB
-
MD5
0bfeac6f3429ba3a48a7940dfe32c133
-
SHA1
71ce4dda4216e954ae1adecd38f88347c32d4037
-
SHA256
c079f044ec528dc2ddc6cb94dad2fa6d2727ec9362b39016278097311a870b1e
-
SHA512
8767277902f08c89785407dae1a549d46810b285d6a8006947674f87d1a2b525345266696396b9d74c1d7d6647c3df778607d134b8bc38bc4e0d88ec80f3ae22
-
SSDEEP
768:5lTPg+94PRtBNSmCYZxZZsLfWtRZhNrqfSkuidXhBx6YsrwrbRGKJI:I+9ErNlzxcL+tDnuSkuidl67rw3RGK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0bfeac6f3429ba3a48a7940dfe32c133_JaffaCakes118
Files
-
0bfeac6f3429ba3a48a7940dfe32c133_JaffaCakes118.sys windows:4 windows x86 arch:x86
259d1a7a49d8d245498d48dd7fb76ec9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
wcslen
ZwCreateKey
RtlInitUnicodeString
swprintf
wcsncpy
wcsrchr
IoRegisterDriverReinitialization
strncmp
KeDelayExecutionThread
KeQuerySystemTime
ObReferenceObjectByHandle
KeTickCount
KeQueryTimeIncrement
_stricmp
_snwprintf
ExAllocatePoolWithTag
wcscat
wcscpy
IoGetCurrentProcess
RtlAnsiStringToUnicodeString
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsSetCreateProcessNotifyRoutine
ZwClose
ZwOpenKey
ZwDeleteKey
MmGetSystemRoutineAddress
ZwSetValueKey
ZwQueryValueKey
_except_handler3
MmIsAddressValid
wcsstr
_wcslwr
PsCreateSystemThread
PsGetVersion
_wcsicmp
_wcsnicmp
ObfDereferenceObject
strncpy
IoDeviceObjectType
RtlCompareUnicodeString
IofCompleteRequest
ExFreePool
_snprintf
ZwCreateFile
ZwSetInformationFile
wcschr
RtlCopyUnicodeString
PsLookupProcessByProcessId
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 58B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 5B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ