Static task
static1
General
-
Target
4243c074aa66a48a4ac12d57e5338b00_JaffaCakes118
-
Size
38KB
-
MD5
4243c074aa66a48a4ac12d57e5338b00
-
SHA1
9719361090ec5a93220ef9f88f4e9607f2c2ff92
-
SHA256
33959de58d5584632ad6f176ffdab9e38aebb6a65ebabbce836583dc70100ef6
-
SHA512
4ff043c3d298820fda75188ac8b612ef355d6197cee0a3c07a53b67f56ee69beae5731372b44f35f9e634682166cdc249507499e0dadda79358d3583fc42e6fd
-
SSDEEP
768:uSrqPj0PuhqNA5ki4i73HaNEqvT2iwosS51o6Y9vZngaTJZK2:uiDPuhWAadi7XaNxrXgg1o6SvZngO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4243c074aa66a48a4ac12d57e5338b00_JaffaCakes118
Files
-
4243c074aa66a48a4ac12d57e5338b00_JaffaCakes118.sys windows:4 windows x86 arch:x86
21673a2708a576a01681f26e8a33515f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlAnsiStringToUnicodeString
RtlInitUnicodeString
swprintf
ZwClose
ZwQueryValueKey
_wcsnicmp
wcslen
KeDelayExecutionThread
KeQuerySystemTime
_wcsicmp
RtlCompareUnicodeString
PsCreateSystemThread
ZwSetValueKey
ZwOpenKey
_except_handler3
_stricmp
wcsstr
_wcslwr
ObReferenceObjectByHandle
ZwCreateFile
wcsncpy
wcsrchr
ZwDeleteKey
IoRegisterDriverReinitialization
strncmp
IoGetCurrentProcess
_snwprintf
wcschr
strncpy
wcscat
wcscpy
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
MmIsAddressValid
IofCompleteRequest
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
MmGetSystemRoutineAddress
KeTickCount
KeQueryTimeIncrement
_snprintf
PsLookupProcessByProcessId
ZwCreateKey
RtlCopyUnicodeString
PsSetCreateProcessNotifyRoutine
IoDeviceObjectType
ZwSetInformationFile
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 5B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 96B - Virtual size: 80B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ