Static task
static1
General
-
Target
3e8b73893e9e6e14d49e5885d57fb3a1_JaffaCakes118
-
Size
40KB
-
MD5
3e8b73893e9e6e14d49e5885d57fb3a1
-
SHA1
1d03bf49a8de6f0b80b44e154bac4611664bd388
-
SHA256
61db5326f6240186fff6fe2ac3bd4b58df59dca8d5b4e42c38539081af47983b
-
SHA512
3074d68ba239739b165dd6ce20ab238cea9baf966cdf07045cda0140717ae0638ea01c3865cf8465c2fc749f276a42f94556e337353dfd03f1ee9b728062acff
-
SSDEEP
768:/+POkEL0wtf/nTQdPWqc6s1IuJWuMNALT0mV+ibxDX5p0XXIgme/BK:/6O3Z1TQZ/bsDJWPDy+4xr56XJ/B
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3e8b73893e9e6e14d49e5885d57fb3a1_JaffaCakes118
Files
-
3e8b73893e9e6e14d49e5885d57fb3a1_JaffaCakes118.sys windows:4 windows x86 arch:x86
fc932a7eb2471c8ee6f3ab7e8f2be6f0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ObfDereferenceObject
MmIsAddressValid
ObReferenceObjectByHandle
ZwOpenKey
RtlInitUnicodeString
wcsncpy
wcsrchr
KeTickCount
KeQueryTimeIncrement
_stricmp
strncpy
IoGetCurrentProcess
MmGetSystemRoutineAddress
swprintf
PsGetVersion
ZwQueryValueKey
ZwSetValueKey
_except_handler3
KeDelayExecutionThread
KeQuerySystemTime
PsLookupProcessByProcessId
wcslen
wcscat
wcscpy
_wcsicmp
PsCreateSystemThread
RtlCompareUnicodeString
strncmp
ExFreePool
_snprintf
ExAllocatePoolWithTag
ZwCreateKey
IoRegisterDriverReinitialization
ZwDeleteKey
ZwCreateFile
ZwSetInformationFile
wcsstr
_wcslwr
IoDeviceObjectType
RtlAnsiStringToUnicodeString
_wcsnicmp
IofCompleteRequest
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
_snwprintf
RtlCopyUnicodeString
wcschr
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 96B - Virtual size: 82B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ