Static task
static1
General
-
Target
3d40fb34d7d224d65680bced984f629f_JaffaCakes118
-
Size
40KB
-
MD5
3d40fb34d7d224d65680bced984f629f
-
SHA1
1b980cfc61a9aa2d3168943560b3e7c0ce7abf18
-
SHA256
9a21b72099ca5be19284b0f58fc062d3a8053ea27956e223af2f3985444023b6
-
SHA512
02f17ca0243b90581ede9876158cf33850abf063e5f923f2ad22695032bea328d7e25a7c427614b06bcda7701029000b43a3241c843ef6d4a1680f646ab2d6df
-
SSDEEP
768:98S0gLB5Haan65LPTIJvD7cDbqGMu90WNU9MhugBlAruZ56ucw4nCfzKpsPBCxoa:yxWJ65gpDA/qm90Wr83re6NyQsPwxoa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3d40fb34d7d224d65680bced984f629f_JaffaCakes118
Files
-
3d40fb34d7d224d65680bced984f629f_JaffaCakes118.sys windows:4 windows x86 arch:x86
c128a832ba8a2ba85aacae33ac75dc20
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwSetInformationFile
ZwCreateFile
RtlInitUnicodeString
wcslen
wcscpy
swprintf
PsSetCreateProcessNotifyRoutine
KeQuerySystemTime
strncmp
_snwprintf
wcsncpy
wcschr
ZwSetValueKey
ZwQueryValueKey
ZwOpenKey
_except_handler3
RtlAnsiStringToUnicodeString
ObfDereferenceObject
_wcsicmp
ZwCreateKey
wcsrchr
IoRegisterDriverReinitialization
wcsstr
_wcslwr
MmIsAddressValid
strncpy
IoGetCurrentProcess
_wcsnicmp
RtlCompareUnicodeString
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlCopyUnicodeString
IofCompleteRequest
wcscat
ZwDeleteKey
ExFreePool
ExAllocatePoolWithTag
IoDeviceObjectType
PsGetVersion
KeDelayExecutionThread
KeTickCount
KeQueryTimeIncrement
_stricmp
ObReferenceObjectByHandle
_snprintf
MmGetSystemRoutineAddress
PsCreateSystemThread
PsLookupProcessByProcessId
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 5B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 64B - Virtual size: 60B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ