Static task
static1
General
-
Target
3e7da8f82ba00aeb9983727c3a89ee4d_JaffaCakes118
-
Size
40KB
-
MD5
3e7da8f82ba00aeb9983727c3a89ee4d
-
SHA1
dd8986bcc25c4d08b866bff1f4c81f18bb10ed97
-
SHA256
685cd3c617cf250ba47528a399ef1df18fb3bfe907fb04718bde793797523eed
-
SHA512
aebbb9c15f42deb738ef29c0e9408fec615f8eb03281a85147d3fcf6cc6b02b364b948298873bf56c51cc0c780310e5672996f4f16759b01130828ca0b6f7774
-
SSDEEP
768:qMWX79hLk3OrmLz3B2EyjVXYL+zCwU1UzXDvwm8/dDOi6C0BcbJKFebd3Cmy+:pcx+UmrB2hXYLACZ1UzXrk1DMC0BeRhX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3e7da8f82ba00aeb9983727c3a89ee4d_JaffaCakes118
Files
-
3e7da8f82ba00aeb9983727c3a89ee4d_JaffaCakes118.sys windows:4 windows x86 arch:x86
eedc7ea1268df1359e4638db4159e467
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
MmIsAddressValid
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ZwClose
ZwSetInformationFile
ZwCreateFile
wcslen
wcscpy
swprintf
IoDeviceObjectType
_snwprintf
wcsncpy
wcschr
ExAllocatePoolWithTag
_wcsicmp
wcsrchr
IofCompleteRequest
ExFreePool
_snprintf
wcscat
ZwOpenKey
KeTickCount
KeQueryTimeIncrement
_stricmp
_wcsnicmp
IoRegisterDriverReinitialization
ZwCreateKey
ObfDereferenceObject
PsCreateSystemThread
PsGetVersion
PsSetCreateProcessNotifyRoutine
ZwDeleteKey
ObReferenceObjectByHandle
IoGetCurrentProcess
ZwQueryValueKey
ZwSetValueKey
RtlCompareUnicodeString
strncpy
PsLookupProcessByProcessId
wcsstr
_wcslwr
_except_handler3
KeQuerySystemTime
MmGetSystemRoutineAddress
strncmp
KeDelayExecutionThread
RtlCopyUnicodeString
RtlAnsiStringToUnicodeString
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 64B - Virtual size: 57B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ