Static task
static1
General
-
Target
33ae5be3e90d97e5c59ccc291ca463ef_JaffaCakes118
-
Size
12KB
-
MD5
33ae5be3e90d97e5c59ccc291ca463ef
-
SHA1
fb079f6d57df8623f2726e9f4956ecbc8171b3c9
-
SHA256
e03fef6361cd2594706d166d19987c1c776e6ab2f3f49ea6c5c2eec552bbefc4
-
SHA512
68420ced6cffa37975339311fa4f2046902d9d09f57dc1857917c0b8c0ce4f753b9021b1ed4bcc514e22d1bf91b0ef41d1bf943068ee0a14b61bf66a390244ce
-
SSDEEP
192:TjwKhTkKxybkgqO4DLaHTMf+4IscoCmJkhLMs3/yowJL/xgX:PhWbkgAXJm4z1aTYJLC
Malware Config
Signatures
Files
-
33ae5be3e90d97e5c59ccc291ca463ef_JaffaCakes118.sys windows:5 windows x86 arch:x86
b7a9ada452380dbef2c10f17db0ca25c
Code Sign
09:35:77:6f:cd:60:c4:8a:43:24:39:26:7b:b7:44:bcCertificate
IssuerCN=VeriSign Class 3 Code Signing 2004 CANot Before14/02/2012, 08:40Not After31/12/2039, 23:59SubjectCN=Tencent Technology(Shenzhen) Company Limited38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15/06/2007, 00:00Not After14/06/2012, 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
RtlInitUnicodeString
_except_handler3
IoCreateFile
IoFreeIrp
KeSetEvent
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
KeInitializeEvent
ObfDereferenceObject
IoAllocateIrp
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
IoFileObjectType
MmGetSystemRoutineAddress
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IofCompleteRequest
ZwClose
KeServiceDescriptorTable
DbgPrint
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
KeBugCheckEx
wcslen
hal
KeGetCurrentIrql
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 452B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 896B - Virtual size: 890B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 384B - Virtual size: 274B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ