Static task
static1
General
-
Target
1a85a5894fd97f6eabfc4deb555be58e_JaffaCakes118
-
Size
39KB
-
MD5
1a85a5894fd97f6eabfc4deb555be58e
-
SHA1
13f1a374cfac55a39660722a99ac0cb94f34eccf
-
SHA256
584cbc61c8df350ba00c0ad5721277436bd23c43d1fb1b7f344b3edada620bc2
-
SHA512
1430afd47517268917d215e560d345690fc39d3dcc3290438f094aadabb68a2a28edd7a74ec6682ac423e3a97002b0c35ab5a88e6ca1b0d4cd14cbcfe3883742
-
SSDEEP
768:XWc4DURqz7Oo1hA0/K+KPw25RSetxhLe0G43u6yjHm:XWc4p2o1m0y1RSetxNe0G43PyjG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1a85a5894fd97f6eabfc4deb555be58e_JaffaCakes118
Files
-
1a85a5894fd97f6eabfc4deb555be58e_JaffaCakes118.sys windows:4 windows x86 arch:x86
317b5f1f6bf030a0cf6b61cac1eb780e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
PsSetCreateProcessNotifyRoutine
KeDelayExecutionThread
KeQuerySystemTime
_wcsicmp
wcsncpy
wcslen
wcsrchr
wcscat
wcscpy
ZwClose
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_except_handler3
ExFreePool
_snprintf
ExAllocatePoolWithTag
swprintf
ZwSetValueKey
ObReferenceObjectByHandle
MmIsAddressValid
RtlCopyUnicodeString
_stricmp
wcsstr
_wcslwr
_wcsnicmp
ZwDeleteKey
ZwCreateKey
IoDeviceObjectType
strncmp
ObfDereferenceObject
PsGetVersion
PsCreateSystemThread
RtlCompareUnicodeString
RtlAnsiStringToUnicodeString
ZwCreateFile
ZwSetInformationFile
MmGetSystemRoutineAddress
IoGetCurrentProcess
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IofCompleteRequest
strncpy
PsLookupProcessByProcessId
IoRegisterDriverReinitialization
_snwprintf
wcschr
KeTickCount
KeQueryTimeIncrement
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 58B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ