Static task
static1
General
-
Target
14754c2c2562d697320e6503aeb88e2b_JaffaCakes118
-
Size
39KB
-
MD5
14754c2c2562d697320e6503aeb88e2b
-
SHA1
76e4559f4b2ed3620ab7134440899fe3de84dec3
-
SHA256
17a17e77201e62f330a96dcd49f78be3d76263c1a26fe35fffef8cb373254610
-
SHA512
a346c52b13671bdde1e4d33a524e3069b872ecff69abde073f7ffbe82c8a6484ca9d017db376de6c0157879ec6c5a070964c32cb71e7d5b4346bacc1c4735c53
-
SSDEEP
768:YiZncy53B/gto9j/1zThu54wbstnLvOewvS2j810tPzl9Uwau5kDHcb9Fi93FSxj:zN9pFgto9hzdgULh0djU0t591aslZFeM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 14754c2c2562d697320e6503aeb88e2b_JaffaCakes118
Files
-
14754c2c2562d697320e6503aeb88e2b_JaffaCakes118.sys windows:4 windows x86 arch:x86
bd8caa0f2e4f037544489f686376fc89
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_wcsnicmp
wcslen
IofCompleteRequest
strncmp
IoGetCurrentProcess
RtlInitUnicodeString
ZwClose
swprintf
ZwOpenKey
ObfDereferenceObject
ExFreePool
_snprintf
ExAllocatePoolWithTag
ZwCreateKey
wcsncpy
wcsrchr
MmIsAddressValid
KeDelayExecutionThread
KeQuerySystemTime
RtlAnsiStringToUnicodeString
ZwCreateFile
ZwSetValueKey
ObReferenceObjectByHandle
strncpy
PsLookupProcessByProcessId
_stricmp
RtlCopyUnicodeString
ZwQueryValueKey
_except_handler3
IoDeviceObjectType
_wcsicmp
PsCreateSystemThread
ZwSetInformationFile
wcscpy
_snwprintf
PsGetVersion
ZwDeleteKey
wcscat
MmGetSystemRoutineAddress
IoRegisterDriverReinitialization
RtlCompareUnicodeString
PsSetCreateProcessNotifyRoutine
wcsstr
_wcslwr
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
wcschr
KeTickCount
KeQueryTimeIncrement
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 54B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ