Static task
static1
General
-
Target
32cb405dc9c2ab5dfc55bf86ae1d724a_JaffaCakes118
-
Size
40KB
-
MD5
32cb405dc9c2ab5dfc55bf86ae1d724a
-
SHA1
c57f348372816b82e7e7c13b9ee181e7cfd650b7
-
SHA256
2f4f4bb2ff049993e7d21f5d97a8816721549d894e682c5e834178111a6450f9
-
SHA512
0df44bad5e8ba763f682d61f07eb35d1b10bf568cea502d519f38376ec7fdfe1827acf9ade96ec35a2250d00b7fc2374e4d7cd43e2630ba0eeaff54853046b57
-
SSDEEP
768:msJlplIzINmrFS4447qJlt9l/SWvsjEPk94a6MSYtQyTr5CXSIKKU2trsS:msJlplKIj44cqUqtkl6AQW5CXaKU2toS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 32cb405dc9c2ab5dfc55bf86ae1d724a_JaffaCakes118
Files
-
32cb405dc9c2ab5dfc55bf86ae1d724a_JaffaCakes118.sys windows:4 windows x86 arch:x86
efbb517c7db07a6dd85a04b50a9041e6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwDeleteKey
ZwOpenKey
RtlInitUnicodeString
ZwSetValueKey
ZwCreateKey
wcslen
wcscat
wcscpy
_wcsicmp
ZwQueryValueKey
_except_handler3
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsGetVersion
MmIsAddressValid
KeTickCount
KeQueryTimeIncrement
_stricmp
strncmp
IoGetCurrentProcess
swprintf
KeQuerySystemTime
strncpy
_wcsnicmp
ObReferenceObjectByHandle
ObfDereferenceObject
IoDeviceObjectType
IoRegisterDriverReinitialization
wcsncpy
wcsrchr
KeDelayExecutionThread
ZwCreateFile
ExFreePool
_snprintf
ExAllocatePoolWithTag
RtlCompareUnicodeString
ZwSetInformationFile
PsCreateSystemThread
_snwprintf
MmGetSystemRoutineAddress
PsSetCreateProcessNotifyRoutine
RtlCopyUnicodeString
wcsstr
_wcslwr
PsLookupProcessByProcessId
wcschr
IofCompleteRequest
RtlAnsiStringToUnicodeString
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 64B - Virtual size: 61B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ