Static task
static1
General
-
Target
411374a016ede87dcc2afcb9125ba0b0_JaffaCakes118
-
Size
40KB
-
MD5
411374a016ede87dcc2afcb9125ba0b0
-
SHA1
e848c0b2ac87078bc815e714cee2924f621c2d04
-
SHA256
0c18cb50c11c9e26514317386d4324f7972d9cc01114359f9145cd2bc18abb69
-
SHA512
ba7c2c90c2e6a52ad986be0782c481f747be6c5498ad184678d29f97df6920fc023f092a860a72cc54d916117b77670ae941400d537fc072684c57136d82eadf
-
SSDEEP
768:AQn8uLnJf5RPi9NaaJy+wo1gQQkUBBNLqW50MW9f06Mz0HVbl7ytWmqsxg:AQbJBRPMaa8zomQjUBBIW6i6br7+nqsa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 411374a016ede87dcc2afcb9125ba0b0_JaffaCakes118
Files
-
411374a016ede87dcc2afcb9125ba0b0_JaffaCakes118.sys windows:4 windows x86 arch:x86
4b577a9c05b66380b3ebbfd472c584ac
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlCompareUnicodeString
RtlInitUnicodeString
ZwClose
ZwDeleteKey
swprintf
IofCompleteRequest
ZwQueryValueKey
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
MmIsAddressValid
ObReferenceObjectByHandle
ZwOpenKey
wcsncpy
wcsrchr
ZwSetValueKey
wcslen
_except_handler3
_wcsnicmp
KeTickCount
KeQueryTimeIncrement
_stricmp
RtlCopyUnicodeString
KeQuerySystemTime
PsCreateSystemThread
wcscat
wcscpy
_wcsicmp
ZwCreateFile
wcsstr
_wcslwr
_snwprintf
wcschr
ZwSetInformationFile
strncpy
IoGetCurrentProcess
PsSetCreateProcessNotifyRoutine
KeDelayExecutionThread
ZwCreateKey
MmGetSystemRoutineAddress
PsLookupProcessByProcessId
PsGetVersion
strncmp
IoDeviceObjectType
IoRegisterDriverReinitialization
_snprintf
RtlAnsiStringToUnicodeString
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEALL Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDATA Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 96B - Virtual size: 66B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ