Static task
static1
General
-
Target
14e32371e01b8dcf5a640df90388217d_JaffaCakes118
-
Size
42KB
-
MD5
14e32371e01b8dcf5a640df90388217d
-
SHA1
665e3c868ca824967e2afdd60aa28aa4ffe231b8
-
SHA256
abf64bb8d7f56052182e90da65a18d2acbc4dcba69c37857e72be3ccbfd00a8f
-
SHA512
25f67e815ae522a894afff2580ebc2a6505ea2c5380494b0ebc7fe4de0402ecf547016839f494032d50b63c4ff9dbd6ff026dfb6f80c27d62b046c7a4b9afc53
-
SSDEEP
384:Km/Y+DmVrgr1PhOKWWQq2I4y6zLXvu4Z6wvuk2nIUyxeflWURTj+IsnTYeIm+SQs:KaYQmVrcgqd4yIjFUaXU95jzsx/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 14e32371e01b8dcf5a640df90388217d_JaffaCakes118
Files
-
14e32371e01b8dcf5a640df90388217d_JaffaCakes118.sys windows:4 windows x86 arch:x86
849a89450826dee0831146a073d82dec
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
wcscat
wcscpy
ExAllocatePoolWithTag
wcslen
ZwClose
ZwCreateFile
IoAttachDeviceToDeviceStack
ObfDereferenceObject
IoCreateDevice
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
RtlInitUnicodeString
swprintf
_strnicmp
IoGetCurrentProcess
strlen
RtlAnsiStringToUnicodeString
RtlInitAnsiString
memcpy
wcsrchr
ZwSetValueKey
ZwDeviceIoControlFile
IoDeleteDevice
IoDeleteSymbolicLink
ExFreePool
IoCreateSymbolicLink
KeQuerySystemTime
PsGetCurrentProcessId
_stricmp
PsLookupProcessByProcessId
PsGetCurrentThreadId
InterlockedExchange
_wcsnicmp
PsSetLoadImageNotifyRoutine
PsSetCreateProcessNotifyRoutine
KeServiceDescriptorTable
ZwOpenKey
ZwEnumerateKey
MmGetSystemRoutineAddress
IoDetachDevice
memset
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
RtlCopyUnicodeString
IoFreeIrp
IofCallDriver
KeGetCurrentThread
IoAllocateIrp
ObQueryNameString
memmove
KeUnstackDetachProcess
sprintf
ZwAllocateVirtualMemory
KeStackAttachProcess
ObOpenObjectByPointer
PsProcessType
ZwSetInformationFile
ZwWriteFile
ZwDeleteKey
ZwCreateKey
ZwQueryValueKey
ZwReadFile
ZwQueryInformationFile
wcsstr
wcschr
IofCompleteRequest
MmUnmapIoSpace
MmMapIoSpace
strcpy
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 408B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ