Static task
static1
General
-
Target
3c8524fc00aef1d358a4dd8263faa5e9_JaffaCakes118
-
Size
40KB
-
MD5
3c8524fc00aef1d358a4dd8263faa5e9
-
SHA1
29e7d34862844c0a40583c2d0ef9b4f16909a6e9
-
SHA256
2e818d60f3db4eb473e5148e0d97d984ba83ee8ba169efc262d66ffcf9afca38
-
SHA512
9d952d1f02894d594423f9299c1250ec6768c4c19ac8dc3731c25315ff41cb40155a6d585366d41c439d1bee4f9c96f171146ba34eb7e2ea2806a9aeaeb3b2a6
-
SSDEEP
768:rmK8gxby9ZCEfocrGXuKtNWXzOYzxkO60fOTsv2BiOVBqaJANzA5:yKpxWCEfocreGXq4Cx0faPrYz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c8524fc00aef1d358a4dd8263faa5e9_JaffaCakes118
Files
-
3c8524fc00aef1d358a4dd8263faa5e9_JaffaCakes118.sys windows:4 windows x86 arch:x86
eb7a301968d81a4a2edc626349894c98
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
MmIsAddressValid
IoDeviceObjectType
wcslen
wcscat
wcscpy
_wcsicmp
ZwClose
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_except_handler3
_wcsnicmp
ObfDereferenceObject
ExFreePool
ExAllocatePoolWithTag
ZwSetValueKey
ZwCreateKey
MmGetSystemRoutineAddress
strncmp
IoGetCurrentProcess
ObReferenceObjectByHandle
_snwprintf
swprintf
wcsncpy
wcsrchr
wcsstr
_wcslwr
RtlAnsiStringToUnicodeString
KeQuerySystemTime
KeDelayExecutionThread
RtlCompareUnicodeString
IoRegisterDriverReinitialization
wcschr
PsCreateSystemThread
ZwSetInformationFile
ZwCreateFile
PsGetVersion
_stricmp
_snprintf
strncpy
ZwDeleteKey
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsSetCreateProcessNotifyRoutine
IofCompleteRequest
KeTickCount
KeQueryTimeIncrement
PsLookupProcessByProcessId
RtlCopyUnicodeString
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 79B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ