Static task
static1
General
-
Target
2b511d12f9fa48c66360ebca00853272_JaffaCakes118
-
Size
40KB
-
MD5
2b511d12f9fa48c66360ebca00853272
-
SHA1
2ff5587277db1876a2ee86db94a9ec0a8b7d7a8a
-
SHA256
55edaa96600ddf137c09f1bb4c984828ada8d73f8571bbb4fcb98e7054313f34
-
SHA512
f9aa3d5e4a1723c5233327560553140cb2bb43614693d04b91f1de7ad0c4fa6c5297343c003bc1ea39168b22319e7a0fa7f0d9e1f454e0ed52bf59a423ca9f02
-
SSDEEP
768:Rm13P6OBxJJ6D5kLxcRzuVEj+wYr7W98lQCfvHUi5cbPt9Y6c6O6xFfZCCNfCKas:Rmlb6tQCaVEj+wYra986CHh6blZCIFfT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2b511d12f9fa48c66360ebca00853272_JaffaCakes118
Files
-
2b511d12f9fa48c66360ebca00853272_JaffaCakes118.sys windows:4 windows x86 arch:x86
a84afe6e46ef19f2cc55a7cf39c9468e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
PsCreateSystemThread
PsSetCreateProcessNotifyRoutine
_stricmp
swprintf
wcsstr
_wcslwr
strncmp
ZwSetValueKey
RtlCompareUnicodeString
RtlInitUnicodeString
ZwOpenKey
KeTickCount
KeQueryTimeIncrement
wcslen
wcscat
wcscpy
_wcsicmp
wcsncpy
wcsrchr
_snwprintf
ExAllocatePoolWithTag
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
MmGetSystemRoutineAddress
ZwCreateKey
RtlCopyUnicodeString
ZwDeleteKey
ExFreePool
ObfDereferenceObject
strncpy
PsLookupProcessByProcessId
IoGetCurrentProcess
_wcsnicmp
KeDelayExecutionThread
KeQuerySystemTime
MmIsAddressValid
ObReferenceObjectByHandle
ZwQueryValueKey
IoDeviceObjectType
_except_handler3
_snprintf
ZwSetInformationFile
ZwCreateFile
RtlAnsiStringToUnicodeString
PsGetVersion
wcschr
IoRegisterDriverReinitialization
IofCompleteRequest
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 50B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ