Static task
static1
General
-
Target
4044d2e3f6e418e59465c0a8efad7f64_JaffaCakes118
-
Size
40KB
-
MD5
4044d2e3f6e418e59465c0a8efad7f64
-
SHA1
02265c3abc598db63d9fdc465481a92a20d08db6
-
SHA256
6f4f92d98a7d712c0a2ccafb64cc0548514032cebd3e9fae9bdf42fa51f23572
-
SHA512
88a9e120537c28f38adf931d29b4c101f854196126b37e9d0b6490c2f0a375fa607f166098cc6468adf38132866970aa41a0ed1c405ae78c21b98f48b6115cd1
-
SSDEEP
768:FFifmYQa1Vxx6EkEoC3KJW01iyiZKtkkzcK8TPaFjcvjGRtvj8gqXQPvbxQ:fumYQavxkDJJWaZkLTPajcbGRtb8gqXF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4044d2e3f6e418e59465c0a8efad7f64_JaffaCakes118
Files
-
4044d2e3f6e418e59465c0a8efad7f64_JaffaCakes118.sys windows:4 windows x86 arch:x86
f557f4433be54ce02306248787f33085
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlCompareUnicodeString
RtlInitUnicodeString
strncmp
IoGetCurrentProcess
_wcsnicmp
wcslen
MmIsAddressValid
IoDeviceObjectType
MmGetSystemRoutineAddress
ZwClose
ZwQueryValueKey
ZwOpenKey
swprintf
wcscat
wcscpy
PsSetCreateProcessNotifyRoutine
_stricmp
wcsstr
_wcslwr
ZwSetValueKey
_except_handler3
IoRegisterDriverReinitialization
ObfDereferenceObject
PsGetVersion
_wcsicmp
wcsncpy
wcsrchr
_snwprintf
ExAllocatePoolWithTag
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ObReferenceObjectByHandle
ZwCreateFile
ZwSetInformationFile
KeQuerySystemTime
wcschr
ZwCreateKey
RtlCopyUnicodeString
PsCreateSystemThread
ZwDeleteKey
ExFreePool
_snprintf
strncpy
PsLookupProcessByProcessId
RtlAnsiStringToUnicodeString
KeTickCount
KeQueryTimeIncrement
KeDelayExecutionThread
IofCompleteRequest
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 62B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ