Static task
static1
General
-
Target
251f8eddb4503aeca187202a99d32b08_JaffaCakes118
-
Size
40KB
-
MD5
251f8eddb4503aeca187202a99d32b08
-
SHA1
b0b3d129e39c594d04850e3808be47abb40745c9
-
SHA256
23e9b2efbe9bb2e16c96b2dded2457403cc04608992dfc6a4524e566915a9354
-
SHA512
50ea5f6945b4867707774c27a0beff2381d8e10793a5796a9cc3b339d0a430059343d3d402947ef8a936cacde5735e9a701be1c937dc4d81fc68d4c43e3b16a2
-
SSDEEP
768:4lkrLGD8UJ7+KKa2b1xhFe/UgSwX4FcGWhx3+KrG:jlUJ7+KKBlFwoFDOhi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 251f8eddb4503aeca187202a99d32b08_JaffaCakes118
Files
-
251f8eddb4503aeca187202a99d32b08_JaffaCakes118.sys windows:4 windows x86 arch:x86
b2e4132132c7bf8acfd657fbf0cd0177
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
strncpy
IoGetCurrentProcess
RtlAnsiStringToUnicodeString
_snwprintf
wcsncpy
wcslen
wcschr
RtlCompareUnicodeString
RtlInitUnicodeString
MmIsAddressValid
ExAllocatePoolWithTag
IoDeviceObjectType
ObReferenceObjectByHandle
swprintf
ObfDereferenceObject
ZwSetValueKey
wcscat
wcscpy
RtlCopyUnicodeString
KeQuerySystemTime
ZwClose
ZwDeleteKey
ExFreePool
_snprintf
PsGetVersion
ZwQueryValueKey
IoRegisterDriverReinitialization
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
KeDelayExecutionThread
ZwOpenKey
wcsrchr
PsCreateSystemThread
PsSetCreateProcessNotifyRoutine
strncmp
_stricmp
wcsstr
_wcslwr
_except_handler3
ZwSetInformationFile
ZwCreateFile
_wcsnicmp
_wcsicmp
ZwCreateKey
KeTickCount
KeQueryTimeIncrement
PsLookupProcessByProcessId
MmGetSystemRoutineAddress
IofCompleteRequest
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 64B - Virtual size: 54B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ