Static task
static1
General
-
Target
1a3b235745369e2234c346b9299497ca_JaffaCakes118
-
Size
40KB
-
MD5
1a3b235745369e2234c346b9299497ca
-
SHA1
5ff80f38afae8eb013a4297670ba6af5f0fa3f07
-
SHA256
58796bc1b9ffbdb6ffd4ef0e52cb1eb870d88ded90572ad39151ffe8749fa503
-
SHA512
b53db70bf5fcb5b9dd65bc42e33c24462596a7dfa9bc52c6bae623963272bd7a422d8e7ab5a3e7ef46654f6cbcaae4e4915de83315ab32c3bffc1a303c3ac94b
-
SSDEEP
768:qPTSnyrZSwIxDaU22atElpVRMd9cU9v05zo2K5DRue5mpYpoVycaxkCiSl:q2yrUwINT2+l8aUtUEr5NFhoccF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1a3b235745369e2234c346b9299497ca_JaffaCakes118
Files
-
1a3b235745369e2234c346b9299497ca_JaffaCakes118.sys windows:4 windows x86 arch:x86
0d116b6aead328f58809201eed228d6b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_wcsnicmp
wcslen
ZwSetValueKey
ZwClose
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_except_handler3
ZwCreateFile
swprintf
ObReferenceObjectByHandle
wcscat
wcscpy
_wcsicmp
PsCreateSystemThread
strncpy
IoGetCurrentProcess
MmIsAddressValid
strncmp
RtlCopyUnicodeString
RtlCompareUnicodeString
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlAnsiStringToUnicodeString
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
IofCompleteRequest
PsSetCreateProcessNotifyRoutine
PsGetVersion
ZwCreateKey
wcsncpy
wcsrchr
MmGetSystemRoutineAddress
_snwprintf
wcschr
KeQuerySystemTime
ZwDeleteKey
_stricmp
wcsstr
_wcslwr
KeTickCount
KeQueryTimeIncrement
KeDelayExecutionThread
ZwSetInformationFile
PsLookupProcessByProcessId
_snprintf
IoDeviceObjectType
IoRegisterDriverReinitialization
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 96B - Virtual size: 65B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ