Static task
static1
General
-
Target
3c2d226df42f278b20c447492f224f26_JaffaCakes118
-
Size
40KB
-
MD5
3c2d226df42f278b20c447492f224f26
-
SHA1
d49641c782eedb1b1bfdf7a7e47fa79f91b90afb
-
SHA256
ceba2de6198009f6f5d4bc3ecac0260501e87e72777084cce8af136a8b25836c
-
SHA512
4e1c5ff37f1b8f9525b3f1e60a0ebe910590eeeef417ef8181e4aaf71cf152191d22409e84c4267797068c791a3c4a04d2f80a91d6dce22c551f9b5c34c60d59
-
SSDEEP
768:wuRM2BbOZ6+K6JHwaYBtFyNk7YRw94mfDqTejnIneFCGmt0cV7/1bgGzIxh1dsR:xa2BqZ6+Ki8XFyxE4UDqe+tdV7/1q1s
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c2d226df42f278b20c447492f224f26_JaffaCakes118
Files
-
3c2d226df42f278b20c447492f224f26_JaffaCakes118.sys windows:4 windows x86 arch:x86
99cf9089f66a803ccbf3fe8ef44aafb8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwDeleteKey
swprintf
RtlCompareUnicodeString
RtlInitUnicodeString
MmIsAddressValid
IoDeviceObjectType
ZwOpenKey
ZwSetValueKey
ZwQueryValueKey
_except_handler3
MmGetSystemRoutineAddress
_stricmp
wcsstr
_wcslwr
ZwSetInformationFile
ZwCreateFile
wcslen
wcscpy
ObReferenceObjectByHandle
KeDelayExecutionThread
KeQuerySystemTime
wcscat
_wcsicmp
ObfDereferenceObject
wcsncpy
wcsrchr
PsGetVersion
strncmp
IoGetCurrentProcess
PsCreateSystemThread
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ExFreePool
ExAllocatePoolWithTag
RtlAnsiStringToUnicodeString
IofCompleteRequest
_snwprintf
PsSetCreateProcessNotifyRoutine
ZwCreateKey
_wcsnicmp
strncpy
RtlCopyUnicodeString
wcschr
_snprintf
PsLookupProcessByProcessId
IoRegisterDriverReinitialization
KeTickCount
KeQueryTimeIncrement
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 65B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ