Static task
static1
General
-
Target
0f2326252b3f63b1d30e681e7cc461bd_JaffaCakes118
-
Size
40KB
-
MD5
0f2326252b3f63b1d30e681e7cc461bd
-
SHA1
d957876069d7ec91bec5b49b50628f27bb98a833
-
SHA256
1a934229552834c089326edf6098efd163dd83ba137047ba12a4eb887ce23f38
-
SHA512
5f1532a9d14fc85b1c91dd8c21b2b61d5f9b9f710a6eadeb7f18f1540919b43296c81e03d18c641a33264a2d9ef8a64ce7603e883e2fd2e35b83cd2edecc47f8
-
SSDEEP
768:Az8uTKlP+PC4Yn2esory0dlS0S2USf9kgrMtMvhYb3KWn1pFmhSR+6RP:Az8GwP+POsory0e0yW9PMCvC3KGFmh5K
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0f2326252b3f63b1d30e681e7cc461bd_JaffaCakes118
Files
-
0f2326252b3f63b1d30e681e7cc461bd_JaffaCakes118.sys windows:4 windows x86 arch:x86
845776c54c7d70a551e1dc77d3b9e0b3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwSetValueKey
wcslen
wcsstr
_wcslwr
KeTickCount
KeQueryTimeIncrement
_stricmp
swprintf
_wcsnicmp
RtlInitUnicodeString
ObfDereferenceObject
ZwClose
ZwQueryValueKey
ZwOpenKey
_except_handler3
MmGetSystemRoutineAddress
MmIsAddressValid
ObReferenceObjectByHandle
wcsncpy
wcsrchr
ExFreePool
_snprintf
ExAllocatePoolWithTag
ZwCreateKey
PsCreateSystemThread
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IoDeviceObjectType
strncmp
IoGetCurrentProcess
_snwprintf
wcschr
wcscat
wcscpy
strncpy
PsLookupProcessByProcessId
ZwCreateFile
_wcsicmp
PsGetVersion
PsSetCreateProcessNotifyRoutine
KeDelayExecutionThread
KeQuerySystemTime
ZwDeleteKey
RtlCompareUnicodeString
RtlCopyUnicodeString
IoRegisterDriverReinitialization
IofCompleteRequest
ZwSetInformationFile
RtlAnsiStringToUnicodeString
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 96B - Virtual size: 66B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ