Static task
static1
General
-
Target
484df9f9eae2749399224a49d3669a8c_JaffaCakes118
-
Size
34KB
-
MD5
484df9f9eae2749399224a49d3669a8c
-
SHA1
38926ac95f50f9a4ddcb3d143a124e30e84bebec
-
SHA256
6d53a422ec2995ff97e5969ea795d43496d7150f896476236a4f091596c7f0b8
-
SHA512
ece8c917e7caad720a6021a8174a35c47c6d534069d7fa962ab8c7bea452ea8d0092bd9c717a51758ab894f0431f03d8b883d9fca822098f88497a600cbed202
-
SSDEEP
768:n3Gu8B2crh/NV08soNA+k0xFFF39IumH2oC2sS/vr4:3+BpF708sl0xFDSumW52s
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 484df9f9eae2749399224a49d3669a8c_JaffaCakes118
Files
-
484df9f9eae2749399224a49d3669a8c_JaffaCakes118.sys windows:4 windows x86 arch:x86
d46e8a9154d5d741b0e8ef1c5cec09f5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwSetValueKey
wcslen
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_except_handler3
RtlAnsiStringToUnicodeString
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
ZwDeleteKey
swprintf
wcsstr
_wcslwr
_stricmp
strncpy
PsLookupProcessByProcessId
ZwCreateFile
MmIsAddressValid
RtlCompareUnicodeString
wcscat
wcscpy
KeTickCount
_wcsicmp
ObReferenceObjectByHandle
IoGetCurrentProcess
PsSetCreateProcessNotifyRoutine
KeQueryTimeIncrement
wcsncpy
wcsrchr
_snwprintf
_wcsnicmp
ZwCreateKey
KeDelayExecutionThread
RtlCopyUnicodeString
IoDeviceObjectType
strncmp
ZwQueryKey
_snprintf
IofCompleteRequest
IoRegisterDriverReinitialization
ObQueryNameString
MmGetSystemRoutineAddress
wcschr
ZwSetInformationFile
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsCreateSystemThread
Sections
.text Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 62B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 640B - Virtual size: 616B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ