Static task
static1
General
-
Target
450e9b24821b87121a768ec809eba506_JaffaCakes118
-
Size
39KB
-
MD5
450e9b24821b87121a768ec809eba506
-
SHA1
364d581b9dcb50b87031a9acdb56220346bbbb8e
-
SHA256
fc17660885e2fa48d5c14f734b71ec30153e5961d941b16d40e725adbb349a43
-
SHA512
cc742fbafceb8090cc6438b39a8610cf281365a3468cc6fa19a3a651eeda37a3ce96ec6d4e0dbce1ffe112cb3c5812d72cc51adec8628e0d7ed87425fa0fc3b2
-
SSDEEP
768:/yN/Fcet6zMuJ17WOlcbeFv+ECIk9a6gehqJdjX2/Bm2J9awPs4O0V7kAkBrpVo5:/Axt6zMuJ1iOllGjYiqJn2J9awPs4zVh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 450e9b24821b87121a768ec809eba506_JaffaCakes118
Files
-
450e9b24821b87121a768ec809eba506_JaffaCakes118.sys windows:4 windows x86 arch:x86
679e79732d8cb613ca5c92cbdf332d21
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwSetValueKey
ZwCreateKey
RtlInitUnicodeString
wcsstr
_wcslwr
RtlAnsiStringToUnicodeString
KeTickCount
KeQueryTimeIncrement
_stricmp
swprintf
ZwOpenKey
wcslen
KeQuerySystemTime
ExFreePool
_snprintf
ExAllocatePoolWithTag
MmIsAddressValid
ZwDeleteKey
MmGetSystemRoutineAddress
_wcsnicmp
ObfDereferenceObject
_wcsicmp
ZwQueryValueKey
_except_handler3
strncpy
IoGetCurrentProcess
RtlCompareUnicodeString
wcsncpy
PsGetVersion
PsSetCreateProcessNotifyRoutine
_snwprintf
wcschr
ObReferenceObjectByHandle
RtlCopyUnicodeString
wcsrchr
wcscat
wcscpy
PsCreateSystemThread
strncmp
ZwCreateFile
KeDelayExecutionThread
PsLookupProcessByProcessId
IoDeviceObjectType
IoRegisterDriverReinitialization
IofCompleteRequest
ZwSetInformationFile
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 53B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ