Static task
static1
General
-
Target
16cfc53f363707d3efe113983a76ee1e_JaffaCakes118
-
Size
40KB
-
MD5
16cfc53f363707d3efe113983a76ee1e
-
SHA1
168c57df055196c32c68075ff70b54907509db8d
-
SHA256
69670fc6700ebaefc27563637b3fb8040cbbd42b3aa9db4725fc69c77f68c79c
-
SHA512
ef6fe9f72b6335c131fb8b4bec32f83df8e3ce142051323484c10d1688c96df5c36cd9f9f613315035f41b1a1702ba3666033a21c05c9488622f076b146a50ab
-
SSDEEP
768:b7iW3mbjOj9Q84qL9l1wb0RibEZsOUYTE12MwozZdICnQA/HZYFCGWGO3sgUpq:b7i7IKqL9l1U0RiisRYTGwozJnQA/HZ6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 16cfc53f363707d3efe113983a76ee1e_JaffaCakes118
Files
-
16cfc53f363707d3efe113983a76ee1e_JaffaCakes118.sys windows:4 windows x86 arch:x86
b7f56329dfba95a2b22193bf40e1cb3f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ObReferenceObjectByHandle
ZwClose
PsCreateSystemThread
PsSetCreateProcessNotifyRoutine
RtlCopyUnicodeString
ZwDeleteKey
ZwOpenKey
RtlInitUnicodeString
strncpy
IoGetCurrentProcess
PsGetVersion
ObfDereferenceObject
swprintf
_wcsnicmp
wcslen
_snwprintf
wcsncpy
wcschr
wcscat
wcscpy
IoRegisterDriverReinitialization
ZwSetValueKey
ZwCreateKey
MmGetSystemRoutineAddress
wcsstr
_wcslwr
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlCompareUnicodeString
wcsrchr
ZwQueryValueKey
ExFreePool
_snprintf
ExAllocatePoolWithTag
MmIsAddressValid
IoDeviceObjectType
_wcsicmp
strncmp
RtlAnsiStringToUnicodeString
IofCompleteRequest
KeTickCount
KeQueryTimeIncrement
_stricmp
KeDelayExecutionThread
KeQuerySystemTime
ZwSetInformationFile
ZwCreateFile
_except_handler3
PsLookupProcessByProcessId
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 43B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ