Static task
static1
General
-
Target
2471c759fd7d2fe524deab9c89dd4fa8_JaffaCakes118
-
Size
40KB
-
MD5
2471c759fd7d2fe524deab9c89dd4fa8
-
SHA1
2f35643d24c4519d79ea7143bc825e8278848f44
-
SHA256
a5874711904687056df96e3475fb34786132df6e27a4edb19e1e121886062493
-
SHA512
7503aeaa59e68b7d3c9162c31aa99277b7656a2661c57e4b9276211f26eede7918656e4c0a51010724d73845a21a0d883e63e734e6b5cc10bd7dca11e3d23d96
-
SSDEEP
768:v55zxjysdCDJOQ+7P8wkOMJZCsRntt1l1sSmWv1WVVcmGjGMDnm9ubGdUByW0O:v55z5ysAtzDwkR3t1bTTWVVcmGCMDiut
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2471c759fd7d2fe524deab9c89dd4fa8_JaffaCakes118
Files
-
2471c759fd7d2fe524deab9c89dd4fa8_JaffaCakes118.sys windows:4 windows x86 arch:x86
938545e0d39f3dfaa4f347f505755e49
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IofCompleteRequest
IoRegisterDriverReinitialization
wcslen
ZwCreateKey
RtlInitUnicodeString
swprintf
wcsncpy
wcsrchr
ZwClose
PsGetVersion
ZwSetValueKey
RtlCompareUnicodeString
strncpy
IoGetCurrentProcess
_wcsnicmp
_stricmp
wcsstr
_wcslwr
ZwCreateFile
ObfDereferenceObject
ZwQueryValueKey
ZwOpenKey
_except_handler3
_wcsicmp
KeTickCount
KeQueryTimeIncrement
ObReferenceObjectByHandle
RtlCopyUnicodeString
KeDelayExecutionThread
KeQuerySystemTime
MmGetSystemRoutineAddress
strncmp
ZwDeleteKey
PsLookupProcessByProcessId
MmIsAddressValid
_snwprintf
ExAllocatePoolWithTag
wcschr
ZwSetInformationFile
wcscpy
wcscat
PsCreateSystemThread
IoDeviceObjectType
RtlAnsiStringToUnicodeString
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ExFreePool
_snprintf
PsSetCreateProcessNotifyRoutine
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 83B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ