Static task
static1
General
-
Target
2c45b18796bd546de6835abfaf9fe0d6_JaffaCakes118
-
Size
39KB
-
MD5
2c45b18796bd546de6835abfaf9fe0d6
-
SHA1
3ee3ea75a15a8b7d40a33794542bee26cdf5762a
-
SHA256
3af7af00bf881e143fa59a2a09feb862e1cee1689e913d64ca24aa06ebdcc44c
-
SHA512
ef4c1b964391523962896b72c69030c8f8a4599efc3606c4db3e0c8e2a6db3b555bdc486dede33f6748cc134ca5fdf942e0f028c05128b966235bd4c1f509658
-
SSDEEP
768:kS3e2Q+Lm0M+iHuhadYWrmfCYHeguEXBSLiy2NmJEbMrf9STmpLmAi:PM+q/zHvYrgQzBhbM7SmpLy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2c45b18796bd546de6835abfaf9fe0d6_JaffaCakes118
Files
-
2c45b18796bd546de6835abfaf9fe0d6_JaffaCakes118.sys windows:4 windows x86 arch:x86
8f9d0f6e409783554ccce29ddeccbc83
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
wcsstr
_wcslwr
MmIsAddressValid
ZwClose
ObfDereferenceObject
ObReferenceObjectByHandle
ZwOpenKey
RtlInitUnicodeString
wcsncpy
wcsrchr
ZwCreateFile
swprintf
wcslen
wcscat
wcscpy
ZwSetValueKey
ZwQueryValueKey
_except_handler3
_stricmp
RtlCopyUnicodeString
IoGetCurrentProcess
PsGetVersion
strncmp
KeDelayExecutionThread
KeQuerySystemTime
ZwDeleteKey
ExFreePool
_snprintf
ExAllocatePoolWithTag
strncpy
PsCreateSystemThread
MmGetSystemRoutineAddress
RtlCompareUnicodeString
ZwSetInformationFile
KeTickCount
KeQueryTimeIncrement
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
_wcsicmp
IoRegisterDriverReinitialization
RtlAnsiStringToUnicodeString
IofCompleteRequest
PsSetCreateProcessNotifyRoutine
_snwprintf
_wcsnicmp
ZwCreateKey
PsLookupProcessByProcessId
IoDeviceObjectType
wcschr
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 5B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 96B - Virtual size: 81B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ