Static task
static1
General
-
Target
2a189051a7d8c2c56a714dc2a0e07779_JaffaCakes118
-
Size
39KB
-
MD5
2a189051a7d8c2c56a714dc2a0e07779
-
SHA1
da8cd2c96205a37664b40c74e8168d22aecf9a59
-
SHA256
b58c55e01ff1245c5222f75798341c7bb70f0a717c3f6bc12a12d8814467d000
-
SHA512
9216c0ecb41c5449b21ff553b579e00fedde174f815d023d8ca712e835fcc115c4e3b5ad0a86a611fd25d8b7f88c344db4fe517940919ad8e5c03f480740bb69
-
SSDEEP
768:Vd/lAPqKRcXOfZlBpTiNCqjCTvOMrCqwR0D6iMWoNCHjuBPY9:T/OyulBpTi00qMgHjuBPY9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2a189051a7d8c2c56a714dc2a0e07779_JaffaCakes118
Files
-
2a189051a7d8c2c56a714dc2a0e07779_JaffaCakes118.sys windows:4 windows x86 arch:x86
a45cc6b33452e408b2825fe1f1fd97b7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitUnicodeString
RtlCompareUnicodeString
ZwClose
PsCreateSystemThread
_snwprintf
ExAllocatePoolWithTag
PsSetCreateProcessNotifyRoutine
wcsncpy
wcslen
wcschr
ZwDeleteKey
ZwOpenKey
wcsstr
_wcslwr
_wcsicmp
strncmp
RtlAnsiStringToUnicodeString
ExFreePool
ObfDereferenceObject
swprintf
ZwSetValueKey
IoRegisterDriverReinitialization
strncpy
PsLookupProcessByProcessId
_stricmp
ObReferenceObjectByHandle
KeTickCount
KeQueryTimeIncrement
ZwQueryValueKey
MmIsAddressValid
wcscat
wcscpy
_wcsnicmp
ZwSetInformationFile
ZwCreateFile
IoGetCurrentProcess
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IoDeviceObjectType
KeDelayExecutionThread
KeQuerySystemTime
PsGetVersion
_except_handler3
wcsrchr
ZwCreateKey
_snprintf
IofCompleteRequest
MmGetSystemRoutineAddress
RtlCopyUnicodeString
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 96B - Virtual size: 74B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ