Static task
static1
General
-
Target
0e68fcf397dd81b011e9865c574f31a0_JaffaCakes118
-
Size
42KB
-
MD5
0e68fcf397dd81b011e9865c574f31a0
-
SHA1
c3c90ba9d38d8a21934376fb09b5d49da2393648
-
SHA256
846ec9254ddf23bb528b62f7d3fa171ad07ced032d8ae0a16a59e6322ebbab42
-
SHA512
b1064986dff8fd7e45ba10697a3ca92e3ced826c74a0587e7c4595ef5f6fa1cd4b3c76ede737820d0a5a660d6c78dbceeed7dd18b3e6a117aa1f9bfa4796efa3
-
SSDEEP
768:KWYQmVrcyaZGs4y0VJD9lD9SbBjD5jzsx/:EQm3IB0VlmxtoN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e68fcf397dd81b011e9865c574f31a0_JaffaCakes118
Files
-
0e68fcf397dd81b011e9865c574f31a0_JaffaCakes118.sys windows:4 windows x86 arch:x86
849a89450826dee0831146a073d82dec
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
wcscat
wcscpy
ExAllocatePoolWithTag
wcslen
ZwClose
ZwCreateFile
IoAttachDeviceToDeviceStack
ObfDereferenceObject
IoCreateDevice
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
RtlInitUnicodeString
swprintf
_strnicmp
IoGetCurrentProcess
strlen
RtlAnsiStringToUnicodeString
RtlInitAnsiString
memcpy
wcsrchr
ZwSetValueKey
ZwDeviceIoControlFile
IoDeleteDevice
IoDeleteSymbolicLink
ExFreePool
IoCreateSymbolicLink
KeQuerySystemTime
PsGetCurrentProcessId
_stricmp
PsLookupProcessByProcessId
PsGetCurrentThreadId
InterlockedExchange
_wcsnicmp
PsSetLoadImageNotifyRoutine
PsSetCreateProcessNotifyRoutine
KeServiceDescriptorTable
ZwOpenKey
ZwEnumerateKey
MmGetSystemRoutineAddress
IoDetachDevice
memset
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
RtlCopyUnicodeString
IoFreeIrp
IofCallDriver
KeGetCurrentThread
IoAllocateIrp
ObQueryNameString
memmove
KeUnstackDetachProcess
sprintf
ZwAllocateVirtualMemory
KeStackAttachProcess
ObOpenObjectByPointer
PsProcessType
ZwSetInformationFile
ZwWriteFile
ZwDeleteKey
ZwCreateKey
ZwQueryValueKey
ZwReadFile
ZwQueryInformationFile
wcsstr
wcschr
IofCompleteRequest
MmUnmapIoSpace
MmMapIoSpace
strcpy
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 408B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ