Static task
static1
General
-
Target
44062fd71325c4a04040bae5c716671b_JaffaCakes118
-
Size
37KB
-
MD5
44062fd71325c4a04040bae5c716671b
-
SHA1
fc462626c7d7f2d8e89f606cb1f02bec2c93fc05
-
SHA256
af9c09420a10ed4bad1e4953835e356946811d6b85aa4ce2e5ad4690ee90f9d4
-
SHA512
453622a84ee662398a6d6dde93e65e8ad5bdc90f77c3937d4f17c1f1e3d641adbe31cf5f0b4db8c8d4e1aaa01c6cfd968c1493dafb178790e5b97f570cddadcc
-
SSDEEP
768:XmrbvJp73p+/xs24ITsxBUbuG8jbd8lqznm7KHCgh8OIVDBKWXene:XmZpQ/xs244sxabVM8lqznm7J+MBKJe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 44062fd71325c4a04040bae5c716671b_JaffaCakes118
Files
-
44062fd71325c4a04040bae5c716671b_JaffaCakes118.sys windows:4 windows x86 arch:x86
c814b907535dc34f54a4d2a3e54e698d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
swprintf
ZwOpenKey
wcslen
wcscat
wcscpy
_wcsicmp
ZwQueryValueKey
RtlInitUnicodeString
_except_handler3
MmIsAddressValid
RtlCompareUnicodeString
ZwSetValueKey
ObReferenceObjectByHandle
_stricmp
wcsstr
_wcslwr
ZwCreateFile
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
KeQuerySystemTime
KeDelayExecutionThread
IofCompleteRequest
PsCreateSystemThread
ZwDeleteKey
_wcsnicmp
ObfDereferenceObject
ExFreePool
ExAllocatePoolWithTag
RtlCopyUnicodeString
MmGetSystemRoutineAddress
strncpy
IoGetCurrentProcess
IoRegisterDriverReinitialization
_snprintf
wcsncpy
wcsrchr
ZwCreateKey
ZwSetInformationFile
strncmp
_snwprintf
wcschr
IoDeviceObjectType
KeTickCount
KeQueryTimeIncrement
PsSetCreateProcessNotifyRoutine
PsLookupProcessByProcessId
RtlAnsiStringToUnicodeString
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 86B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 640B - Virtual size: 616B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ