Static task
static1
General
-
Target
1912f5bf211fded5ffd177fdc9aadd9f_JaffaCakes118
-
Size
40KB
-
MD5
1912f5bf211fded5ffd177fdc9aadd9f
-
SHA1
484145b9b98740c6875757535d263eaa33bb6be0
-
SHA256
0f62209560ba7a6695cb12d219f5e7c508ec90ec2ffa50c8f8f743af9cc695df
-
SHA512
bbbb6354f91c7f189212f2148aa28319ac916c4eca65e397ddb0857a231a806bc4c4315968d13e1b0abd499c2765c16e6b6e2e8556a4f8b7bae61b0450898afa
-
SSDEEP
768:eQbY1Qm8xDcS8FKdPgVp3A0ULtveI4i+5CKIQjnH8KRrtD+mvhXou3h:RY6PxDCKdgVp3A04vV4JChQb8NmJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1912f5bf211fded5ffd177fdc9aadd9f_JaffaCakes118
Files
-
1912f5bf211fded5ffd177fdc9aadd9f_JaffaCakes118.sys windows:4 windows x86 arch:x86
8973b955c4ff13e17148bfe3fceea58d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
PsGetVersion
PsCreateSystemThread
KeTickCount
KeQueryTimeIncrement
_stricmp
IoRegisterDriverReinitialization
MmIsAddressValid
_wcsicmp
wcsncpy
wcslen
wcsrchr
ZwSetValueKey
ZwDeleteKey
ZwOpenKey
RtlInitUnicodeString
ZwQueryValueKey
_except_handler3
strncpy
IoGetCurrentProcess
swprintf
_wcsnicmp
MmGetSystemRoutineAddress
IofCompleteRequest
ExFreePool
_snprintf
ExAllocatePoolWithTag
ObReferenceObjectByHandle
RtlCopyUnicodeString
RtlAnsiStringToUnicodeString
wcscat
wcscpy
IoDeviceObjectType
ZwCreateKey
strncmp
RtlCompareUnicodeString
wcsstr
_wcslwr
ObfDereferenceObject
PsLookupProcessByProcessId
PsSetCreateProcessNotifyRoutine
_snwprintf
ZwCreateFile
ZwSetInformationFile
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
KeDelayExecutionThread
KeQuerySystemTime
wcschr
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 59B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ