Static task
static1
General
-
Target
2a32671c14d99d164b6453180134869d_JaffaCakes118
-
Size
40KB
-
MD5
2a32671c14d99d164b6453180134869d
-
SHA1
b4d3fbbc8546a25bc430bbe9509274f76bf14521
-
SHA256
4ad0ca4f0345b877fb9911d7d922ea145d94d3ff2ab7f9f411d89eafd554860e
-
SHA512
707f16b3c9a2ae40cd8ee608c8d7e27e47212e116162b35d0c813672543c797de746fcd2e26bbcbe602e54362386901b9d4fc5cd58bd4d8889ad6194855eddd1
-
SSDEEP
768:c/ro3JWFtG64uKkH9yxzPXFRnwA01pN5uglP0WlM+ZSHXxVjjH:czo3JEG6yzPbtEt5lM++nnH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2a32671c14d99d164b6453180134869d_JaffaCakes118
Files
-
2a32671c14d99d164b6453180134869d_JaffaCakes118.sys windows:4 windows x86 arch:x86
b31aac23806ec5a7ccb59897aa2b8672
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
wcsstr
_wcslwr
wcslen
swprintf
wcscat
wcscpy
RtlInitUnicodeString
strncpy
IoGetCurrentProcess
KeDelayExecutionThread
KeQuerySystemTime
RtlCopyUnicodeString
ZwSetValueKey
ObReferenceObjectByHandle
ExFreePool
ExAllocatePoolWithTag
ZwClose
ObfDereferenceObject
IofCompleteRequest
MmIsAddressValid
IoDeviceObjectType
ZwCreateFile
_wcsnicmp
ZwOpenKey
ZwCreateKey
wcsncpy
wcsrchr
ZwQueryValueKey
_except_handler3
PsCreateSystemThread
RtlCompareUnicodeString
RtlAnsiStringToUnicodeString
PsGetVersion
_snwprintf
wcschr
ZwDeleteKey
_wcsicmp
KeTickCount
KeQueryTimeIncrement
_stricmp
IoRegisterDriverReinitialization
PsSetCreateProcessNotifyRoutine
MmGetSystemRoutineAddress
PsLookupProcessByProcessId
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
strncmp
_snprintf
ZwSetInformationFile
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 94B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEALL Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ