Static task
static1
General
-
Target
0d051c9972629d42579de405bb8b0253_JaffaCakes118
-
Size
39KB
-
MD5
0d051c9972629d42579de405bb8b0253
-
SHA1
e6f57eea3f959c82e2ca0c902545498f812ddecb
-
SHA256
002608f159174c1559cd52d5b60ce8c7b468c63d441c7c6b67a04079445b8f33
-
SHA512
2d9d0d921a9ac4db0c828b1eff4b1b7ccc7e829a73fe6892b99044946b4a09e45858fa709aa21881db0697cce567c5696b8d5b3d58ab9b143668f07948ca3730
-
SSDEEP
768:31h2xypy9mfCmXozBtoV7SA1ZoYJSah4JAAdn3zk3VbXS3p3TLn9sGLr2Gfkv:31hJE9kCm4zBtoV+A1JJSah+AWDk3VzU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d051c9972629d42579de405bb8b0253_JaffaCakes118
Files
-
0d051c9972629d42579de405bb8b0253_JaffaCakes118.sys windows:4 windows x86 arch:x86
860d72d7e984ed138579ef9010313c08
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExFreePool
ExAllocatePoolWithTag
ZwClose
ObfDereferenceObject
MmIsAddressValid
ObReferenceObjectByHandle
ZwOpenKey
RtlInitUnicodeString
wcsncpy
wcsrchr
wcslen
ZwCreateKey
swprintf
_wcsnicmp
PsGetVersion
ZwSetValueKey
ZwQueryValueKey
_except_handler3
wcsstr
_wcslwr
RtlCompareUnicodeString
IoDeviceObjectType
strncpy
IoGetCurrentProcess
IofCompleteRequest
_snprintf
_snwprintf
RtlAnsiStringToUnicodeString
ZwSetInformationFile
ZwCreateFile
wcscpy
PsLookupProcessByProcessId
_stricmp
wcschr
MmGetSystemRoutineAddress
strncmp
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsSetCreateProcessNotifyRoutine
KeQuerySystemTime
RtlCopyUnicodeString
KeTickCount
KeQueryTimeIncrement
ZwDeleteKey
_wcsicmp
PsCreateSystemThread
KeDelayExecutionThread
wcscat
IoRegisterDriverReinitialization
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 5B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 96B - Virtual size: 77B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ