Static task
static1
General
-
Target
2702e34408bbdcc3b52e0fca83af9174_JaffaCakes118
-
Size
39KB
-
MD5
2702e34408bbdcc3b52e0fca83af9174
-
SHA1
fbbe497d0cce32ae12cf9d6d1ff8c3b37e6b2408
-
SHA256
92cea17c6786c71fa23a7c8ce0b1eebf774600ea400b6be30e0ebdad06dd8f7d
-
SHA512
9204b63ec87cd3bb9eb71743c125f643cc38b5fda7127155f625f28ec4529f66951aa8f12e8f982448413b8bab1d9783bc3f6716143e9e1f56c05bed09680139
-
SSDEEP
768:jQ8zRu6Zs2k1Wt3bPZkD4pFDhkPyS9YCcNNtW/2pajrHPhsWcXaBZRaODqWTSZVC:jQ8l/Zskt3tySyPySefNNtJajzhLcX8X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2702e34408bbdcc3b52e0fca83af9174_JaffaCakes118
Files
-
2702e34408bbdcc3b52e0fca83af9174_JaffaCakes118.sys windows:4 windows x86 arch:x86
1bfa8420eaf5cb00340d379ed1611272
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwSetValueKey
wcslen
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ZwClose
ZwQueryValueKey
ZwOpenKey
_except_handler3
_wcsnicmp
IofCompleteRequest
RtlCopyUnicodeString
swprintf
wcscat
wcscpy
ObfDereferenceObject
strncmp
IoGetCurrentProcess
_wcsicmp
ZwCreateKey
RtlCompareUnicodeString
_stricmp
wcsstr
_wcslwr
MmIsAddressValid
ObReferenceObjectByHandle
ZwDeleteKey
PsCreateSystemThread
KeDelayExecutionThread
KeQuerySystemTime
wcsncpy
wcsrchr
RtlAnsiStringToUnicodeString
ExFreePool
ExAllocatePoolWithTag
strncpy
IoRegisterDriverReinitialization
ZwSetInformationFile
ZwCreateFile
_snwprintf
wcschr
MmGetSystemRoutineAddress
_snprintf
PsSetCreateProcessNotifyRoutine
KeTickCount
KeQueryTimeIncrement
PsGetVersion
PsLookupProcessByProcessId
IoDeviceObjectType
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 64B - Virtual size: 52B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ