Static task
static1
General
-
Target
0ecb7424749f99eb3f3f437db68d856f_JaffaCakes118
-
Size
37KB
-
MD5
0ecb7424749f99eb3f3f437db68d856f
-
SHA1
f94e7c3fecde3e06a9952e1297d657722c00eeb2
-
SHA256
0ae915fc12c397e4f92c2e8ab42c30cf50f115df429bd754140884fd809b4a69
-
SHA512
4457e725daaccbc0a1324a9454f61c333c7dc43de626890a7dc7e6ade6c70a60ff12643f6c7b2e03ab7f33a979de0a171eebcea644a15865f51431de0e13b14c
-
SSDEEP
768:sF25uzqnylVDiq0BhheoiQZt+ta+VEjfq9jeNgIRa6nksYyYhM:sF2wzqnYxA6NQZYtaypjigIRa6HY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ecb7424749f99eb3f3f437db68d856f_JaffaCakes118
Files
-
0ecb7424749f99eb3f3f437db68d856f_JaffaCakes118.sys windows:4 windows x86 arch:x86
b34f9c22b215844c17bb14a14ba39897
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
MmIsAddressValid
IoDeviceObjectType
_wcsnicmp
wcslen
RtlInitUnicodeString
ObfDereferenceObject
swprintf
ZwClose
ZwSetInformationFile
ZwCreateFile
wcscpy
strncmp
MmGetSystemRoutineAddress
ExFreePool
ExAllocatePoolWithTag
ZwSetValueKey
wcsstr
_wcslwr
RtlCompareUnicodeString
IofCompleteRequest
strncpy
PsLookupProcessByProcessId
_stricmp
KeTickCount
KeQueryTimeIncrement
ZwDeleteKey
_snwprintf
IoGetCurrentProcess
ZwOpenKey
_snprintf
KeDelayExecutionThread
KeQuerySystemTime
wcscat
_wcsicmp
wcsncpy
wcsrchr
ZwQueryValueKey
_except_handler3
RtlCopyUnicodeString
wcschr
RtlAnsiStringToUnicodeString
ObReferenceObjectByHandle
PsSetCreateProcessNotifyRoutine
PsCreateSystemThread
ZwCreateKey
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IoRegisterDriverReinitialization
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 59B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 5B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ