Static task
static1
General
-
Target
4bce7997d572d0847f1ff363f4b1518a_JaffaCakes118
-
Size
40KB
-
MD5
4bce7997d572d0847f1ff363f4b1518a
-
SHA1
5f10838096e7622adf98d8db903e42be3c6ebef5
-
SHA256
d87b393e67ee7dbcc68c764023647fc5ebcec5df0ecc3baefa348a8d968ef42c
-
SHA512
60c083bbd2196a61103e2e4c897fcc825a19dbf85d7f9ff1c72719b102e88c7278add27d9b4ede3013397cd1e478684a44580ff7b7797ec665c0eebaab056e9e
-
SSDEEP
768:c2VsYYI3iiFPgOlxr40rd+y1QH3HNvAW5SHAHjYuEM2ZTz07Nh:vsNEiiFYsr40Z+y1QXHNo3Kj6z2n
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4bce7997d572d0847f1ff363f4b1518a_JaffaCakes118
Files
-
4bce7997d572d0847f1ff363f4b1518a_JaffaCakes118.sys windows:4 windows x86 arch:x86
7bcc0a52ab088006f8a9880faa86a171
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
swprintf
ZwOpenKey
RtlInitUnicodeString
_wcsnicmp
wcslen
ObfDereferenceObject
ZwQueryValueKey
MmIsAddressValid
ObReferenceObjectByHandle
wcsncpy
wcsrchr
ExFreePool
_snprintf
ExAllocatePoolWithTag
_snwprintf
wcschr
ZwSetValueKey
ZwCreateKey
ZwSetInformationFile
ZwCreateFile
wcscpy
ZwDeleteKey
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
MmGetSystemRoutineAddress
_except_handler3
_wcsicmp
RtlCompareUnicodeString
KeDelayExecutionThread
KeQuerySystemTime
IofCompleteRequest
RtlAnsiStringToUnicodeString
RtlCopyUnicodeString
strncmp
IoGetCurrentProcess
wcscat
PsSetCreateProcessNotifyRoutine
_stricmp
wcsstr
_wcslwr
KeTickCount
KeQueryTimeIncrement
PsGetVersion
strncpy
IoRegisterDriverReinitialization
IoDeviceObjectType
PsLookupProcessByProcessId
PsCreateSystemThread
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEALL Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 96B - Virtual size: 73B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ