Static task
static1
General
-
Target
3d740caae3a5aa92693de857f38b7032_JaffaCakes118
-
Size
37KB
-
MD5
3d740caae3a5aa92693de857f38b7032
-
SHA1
f3dbbed5331084de9cd58197e1bb7c58e1770df9
-
SHA256
163cddfaf71d59482db0bc51444241476212484f56e33dde0e0f65df7988ae19
-
SHA512
47d49c1a9d4daa6eef3a65f1b6f6579f358ff6de03c47f43d6780b3ad7f1ec3149ddc1a668e00ec506351e94091c4f8f6f002d1adad1539514c26b704cdfb5b9
-
SSDEEP
768:fACRYrtsUvKryjuMjkrwSrWSjScFOeZrpeZSmu3Z149sfne1hOyUkQS:fACTWsyKMjgwSaSm0TJLQ9mqckQS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3d740caae3a5aa92693de857f38b7032_JaffaCakes118
Files
-
3d740caae3a5aa92693de857f38b7032_JaffaCakes118.sys windows:4 windows x86 arch:x86
a596dc01c8f7470044328ed6732987a9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
RtlAnsiStringToUnicodeString
ZwSetValueKey
KeQuerySystemTime
wcslen
_except_handler3
_wcsicmp
wcsncpy
wcsrchr
wcsstr
_wcslwr
KeDelayExecutionThread
ZwCreateFile
swprintf
IoRegisterDriverReinitialization
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
strncmp
_wcsnicmp
ZwCreateKey
strncpy
IoGetCurrentProcess
_snprintf
MmIsAddressValid
PsCreateSystemThread
RtlCompareUnicodeString
_stricmp
KeTickCount
KeQueryTimeIncrement
ObReferenceObjectByHandle
PsLookupProcessByProcessId
PsSetCreateProcessNotifyRoutine
ZwDeleteKey
MmGetSystemRoutineAddress
IofCompleteRequest
wcscat
wcscpy
ZwSetInformationFile
RtlCopyUnicodeString
_snwprintf
IoDeviceObjectType
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
wcschr
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 58B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 5B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ