Static task
static1
General
-
Target
2fd36388f64a81fa4d7e081b2373d1ed_JaffaCakes118
-
Size
40KB
-
MD5
2fd36388f64a81fa4d7e081b2373d1ed
-
SHA1
47553ad8a71ad6a378bf3d9e6c368fb45a79ed83
-
SHA256
c84566a24569f8689780c8e5639af6d0615ca8075876bc742857c52d768ca131
-
SHA512
ec34bf2d9955df978087c94647db4ce69243e4f76a25e2c8171194ecb68d605cb69974842abfeffc7800f7ad963463b451aaf93ec81ddb2b9f65f30318a66693
-
SSDEEP
768:aaI0pAC6vex12RbiKvLiYh+t3hPqQ+5b1ov7UV3mg+KcRSWaRrUSxFKv5iS8qbu5:kDC62MGKTqbGb1ov7Q2gLuSWaRrtHaiS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2fd36388f64a81fa4d7e081b2373d1ed_JaffaCakes118
Files
-
2fd36388f64a81fa4d7e081b2373d1ed_JaffaCakes118.sys windows:4 windows x86 arch:x86
fcfcdd70c1d3b22832a45419e55f467b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
strncmp
strncpy
PsLookupProcessByProcessId
_stricmp
RtlAnsiStringToUnicodeString
KeQuerySystemTime
RtlInitUnicodeString
ZwClose
ZwSetValueKey
ZwCreateKey
PsSetCreateProcessNotifyRoutine
ZwQueryValueKey
ZwDeleteKey
ZwOpenKey
ZwCreateFile
swprintf
ExFreePool
_snprintf
ExAllocatePoolWithTag
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
wcslen
IoRegisterDriverReinitialization
wcsncpy
MmIsAddressValid
IoGetCurrentProcess
PsGetVersion
wcsrchr
wcsstr
_wcslwr
ObfDereferenceObject
IoDeviceObjectType
RtlCopyUnicodeString
ObReferenceObjectByHandle
MmGetSystemRoutineAddress
_wcsicmp
_snwprintf
_except_handler3
KeDelayExecutionThread
_wcsnicmp
PsCreateSystemThread
IofCompleteRequest
RtlCompareUnicodeString
wcschr
wcscat
wcscpy
KeTickCount
KeQueryTimeIncrement
ZwSetInformationFile
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 64B - Virtual size: 57B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ