Static task
static1
General
-
Target
164a20c0319565b20d89b8764f4b5c9c_JaffaCakes118
-
Size
40KB
-
MD5
164a20c0319565b20d89b8764f4b5c9c
-
SHA1
a49f674b3d3fda0b51147dbca209a1d5c31583ab
-
SHA256
92b0cb05a1274b83270df85ea93179458772608922535b8e8df7a2680c6d8e0c
-
SHA512
bd9a4c171be210d2b0ed9f5da07318e49d3143369c809b507785bd429d91b463a3e1ca3f38445ff090c8d68fc58942eb7d59a3206dab84a3c1d6f1b8c8c66cb6
-
SSDEEP
768:GCg94bEC7B6g821tbLxWgL+jE4K+RqgfcbVSoodZbiHz6nk2EStOXDSPY0YPUuQ:TfIQBdLmRteVJ+NiZ2JkeY7Uu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 164a20c0319565b20d89b8764f4b5c9c_JaffaCakes118
Files
-
164a20c0319565b20d89b8764f4b5c9c_JaffaCakes118.sys windows:4 windows x86 arch:x86
f7859c267fb8dc75c4cc0f9f1a8fe710
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
MmIsAddressValid
KeQuerySystemTime
ZwSetValueKey
strncpy
PsLookupProcessByProcessId
_stricmp
KeDelayExecutionThread
ZwClose
swprintf
ZwOpenKey
RtlInitUnicodeString
wcsstr
_wcslwr
ObReferenceObjectByHandle
ObfDereferenceObject
RtlCompareUnicodeString
_wcsicmp
_snwprintf
ExAllocatePoolWithTag
RtlCopyUnicodeString
ZwQueryValueKey
_except_handler3
wcsncpy
IoGetCurrentProcess
PsGetVersion
wcslen
ZwCreateKey
wcsrchr
ZwCreateFile
strncmp
wcscat
wcscpy
IoDeviceObjectType
wcschr
ExFreePool
_snprintf
PsSetCreateProcessNotifyRoutine
_wcsnicmp
PsCreateSystemThread
ZwSetInformationFile
MmGetSystemRoutineAddress
IofCompleteRequest
RtlAnsiStringToUnicodeString
ZwDeleteKey
KeTickCount
KeQueryTimeIncrement
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IoRegisterDriverReinitialization
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 57B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEALL Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ