Static task
static1
General
-
Target
21fd8cef43efb806b87a0d7039f6b199_JaffaCakes118
-
Size
39KB
-
MD5
21fd8cef43efb806b87a0d7039f6b199
-
SHA1
40a85acbd5ee7e5e11d435c6fdfbd0f68ffb6ded
-
SHA256
c9076d6e29576834ce51cde122be9b38839671c8904b184272e6bdf4708a7650
-
SHA512
b30ac70f9ff1c1b9ce0a289ffacf49e43f7a9fb918666e4aa878e9fbe8796155175ec7ce53da7fa95002e11793bb33a8f1a93df6bb7a1e117b0992615752304a
-
SSDEEP
768:mBpUMVOxYTJGzvwEnF8zgsxEHcrCurjXMshVsBFR7DSwH9cSjMs1Idt+ewj2+npU:mBpUMVSHzNWbE8rvtsBz7DHH9c69O+Ni
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 21fd8cef43efb806b87a0d7039f6b199_JaffaCakes118
Files
-
21fd8cef43efb806b87a0d7039f6b199_JaffaCakes118.sys windows:4 windows x86 arch:x86
c81f62ddf9b141df5b97a1b775447e4c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwSetValueKey
wcslen
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_except_handler3
PsSetCreateProcessNotifyRoutine
MmIsAddressValid
IoRegisterDriverReinitialization
strncpy
PsLookupProcessByProcessId
_stricmp
IofCompleteRequest
_snwprintf
wcsncpy
wcschr
MmGetSystemRoutineAddress
ObfDereferenceObject
ObReferenceObjectByHandle
wcsrchr
RtlCompareUnicodeString
PsGetVersion
KeQuerySystemTime
ZwCreateKey
swprintf
_wcsnicmp
ExAllocatePoolWithTag
IoDeviceObjectType
wcsstr
_wcslwr
strncmp
IoGetCurrentProcess
RtlCopyUnicodeString
ExFreePool
_snprintf
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
KeDelayExecutionThread
KeTickCount
KeQueryTimeIncrement
ZwDeleteKey
_wcsicmp
ZwCreateFile
ZwSetInformationFile
wcscpy
wcscat
RtlAnsiStringToUnicodeString
PsCreateSystemThread
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 5B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 96B - Virtual size: 72B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ