Static task
static1
General
-
Target
42c60ac7bf2aa8ddb687b5e5a3b48d74_JaffaCakes118
-
Size
39KB
-
MD5
42c60ac7bf2aa8ddb687b5e5a3b48d74
-
SHA1
2b9016548e482a474a4ec3b0e6570ab63b87f039
-
SHA256
6fbc4fd1ce66c934daa46b165074eb0f81a46003bc7da6fbb5e1911714f54be7
-
SHA512
e5dfa9edc8772abdb89e13e2e0f2428e8de7a004f66f9958cf5dc7ced0ecc4d499629fb8abd070c2ada7629a7f962bc2c7c4235f0c0029e6690bcd774a965e1a
-
SSDEEP
768:LqPrKtCKdDCWsP7sCk+vcdGg9mYPWAIDA0n0ANbAzxfeOTFvPYSPuo:MrKtCKU7sZUg9xwD/n0/zP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 42c60ac7bf2aa8ddb687b5e5a3b48d74_JaffaCakes118
Files
-
42c60ac7bf2aa8ddb687b5e5a3b48d74_JaffaCakes118.sys windows:4 windows x86 arch:x86
a7e931d4a33607427acd649049745d02
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExFreePool
_snprintf
ExAllocatePoolWithTag
IofCompleteRequest
_wcsicmp
wcsncpy
wcslen
wcsrchr
RtlCopyUnicodeString
PsSetCreateProcessNotifyRoutine
swprintf
RtlInitUnicodeString
ZwClose
MmIsAddressValid
ZwSetInformationFile
ZwCreateFile
wcscpy
RtlCompareUnicodeString
ZwDeleteKey
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsCreateSystemThread
wcscat
ObfDereferenceObject
ZwOpenKey
ZwCreateKey
_stricmp
wcsstr
_wcslwr
ZwSetValueKey
ZwQueryValueKey
_except_handler3
IoRegisterDriverReinitialization
_wcsnicmp
strncmp
KeQuerySystemTime
_snwprintf
wcschr
PsGetVersion
RtlAnsiStringToUnicodeString
IoGetCurrentProcess
ObReferenceObjectByHandle
strncpy
IoDeviceObjectType
PsLookupProcessByProcessId
KeDelayExecutionThread
MmGetSystemRoutineAddress
KeTickCount
KeQueryTimeIncrement
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 56B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ