Static task
static1
General
-
Target
22e53761f414ea1484d7b6b623153642_JaffaCakes118
-
Size
40KB
-
MD5
22e53761f414ea1484d7b6b623153642
-
SHA1
f6d067542378a7e5b05e1a4056c58f71498aa6e9
-
SHA256
a115277f981b7db223528e5e366d1540247e217ecc325078566fdd1220baaf2f
-
SHA512
20e6be82e889ac63821b1824ac148b5d01d785a8e4bdd9b32bbc9dd12ccf26bd4999aa664ce07b89c7ac6834037d5da69bd47476f080cbbe36e3eb8dc8b75e52
-
SSDEEP
768:w8RH3rxzv/2unys0zsPG+3G1zGuOFiIJgek7lgb33zsD90K+pBz9TAWQ74jFStIt:JRXrxhys0gPWaVFiIJgek7lgzjyE/z00
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 22e53761f414ea1484d7b6b623153642_JaffaCakes118
Files
-
22e53761f414ea1484d7b6b623153642_JaffaCakes118.sys windows:4 windows x86 arch:x86
294b9fd668beb18fc28467e8787f4d94
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeQuerySystemTime
ZwClose
PsGetVersion
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
_wcsicmp
wcsncpy
wcslen
wcsrchr
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
ZwQueryValueKey
wcsstr
_wcslwr
swprintf
ZwSetValueKey
ZwOpenKey
_except_handler3
RtlCompareUnicodeString
MmIsAddressValid
_snprintf
ObReferenceObjectByHandle
ZwDeleteKey
IoRegisterDriverReinitialization
_snwprintf
wcschr
RtlCopyUnicodeString
_wcsnicmp
ZwCreateKey
IofCompleteRequest
wcscat
wcscpy
strncpy
PsLookupProcessByProcessId
_stricmp
MmGetSystemRoutineAddress
RtlAnsiStringToUnicodeString
PsSetCreateProcessNotifyRoutine
ZwCreateFile
PsCreateSystemThread
strncmp
IoGetCurrentProcess
ZwSetInformationFile
KeTickCount
KeQueryTimeIncrement
IoDeviceObjectType
KeDelayExecutionThread
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 77B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ