Static task
static1
General
-
Target
1861788a0e3ece83f77ef1e5d84cc85d_JaffaCakes118
-
Size
32KB
-
MD5
1861788a0e3ece83f77ef1e5d84cc85d
-
SHA1
76033a394a07f28b547290d99638f0d923c794de
-
SHA256
97696688219a012bac8d719c2ba246f6e6bfe89659a027b3bbd83d882117ebdf
-
SHA512
39c187f64d98edaf5e3ecd1bd4a17b1c60b6b665fd38137dce4582ebc5134edc39685bd77ebf65d4c4aa8ef2623d5e48a9e73bad9b8d90b66d385f2871f2d44c
-
SSDEEP
768:0ukYphT+cFHpun7ESi47zxv5+S2JnwVj2zTu/q3B3VymBGUZDh:0uac+n7ESi47BGqVCPuC3B3/BGODh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1861788a0e3ece83f77ef1e5d84cc85d_JaffaCakes118
Files
-
1861788a0e3ece83f77ef1e5d84cc85d_JaffaCakes118.sys windows:4 windows x86 arch:x86
0f0cef34404d42e85ad1e158ffe6f79d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_snwprintf
ExAllocatePoolWithTag
RtlInitUnicodeString
ObReferenceObjectByHandle
ZwSetValueKey
ZwClose
ZwSetInformationFile
ZwCreateFile
wcslen
wcscpy
swprintf
PsCreateSystemThread
strncpy
IoGetCurrentProcess
ExFreePool
_snprintf
MmIsAddressValid
_wcsicmp
wcsncpy
wcsrchr
ObfDereferenceObject
ZwOpenKey
ZwEnumerateKey
ZwQueryKey
KeQuerySystemTime
ZwQueryValueKey
_except_handler3
strncmp
ZwDeleteKey
PsSetCreateProcessNotifyRoutine
ZwCreateKey
_stricmp
RtlCopyUnicodeString
_wcsnicmp
RtlCompareUnicodeString
ObQueryNameString
IofCompleteRequest
RtlAnsiStringToUnicodeString
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlConvertSidToUnicodeString
ZwQueryInformationToken
ObOpenObjectByPointer
PsReferencePrimaryToken
IoRegisterDriverReinitialization
wcsstr
_wcslwr
MmGetSystemRoutineAddress
wcschr
KeDelayExecutionThread
PsLookupProcessByProcessId
Sections
.text Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 50B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 640B - Virtual size: 616B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ