Static task
static1
General
-
Target
4dc30a13f344a07898e5dba513b5aa32_JaffaCakes118
-
Size
40KB
-
MD5
4dc30a13f344a07898e5dba513b5aa32
-
SHA1
c48b658007dfe4d425c63bcbe13d9432d935341f
-
SHA256
472245ab949b538519902e97241ca4549a3ea3f6b501cd0273036ff15a8ff482
-
SHA512
94f6eeab76eafebc27f449ce0708edb8682552781941abc021e5884c21f5af8bf81b88b1f1ac74d2fa450f2faf12ce0870e1c098d7f28449e5459e64fccf6e3c
-
SSDEEP
768:+/OGjHM4ZuygTZsz30kuKVSXpALYp5OXKhWCYG9WhVinvQoT7yWuWenSb:cpjh07ezkqUsYLMGWCY9hVinvQVC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4dc30a13f344a07898e5dba513b5aa32_JaffaCakes118
Files
-
4dc30a13f344a07898e5dba513b5aa32_JaffaCakes118.sys windows:4 windows x86 arch:x86
abe64385d70fcebaec93f265ba5dcbe7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
strncmp
IoGetCurrentProcess
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ZwClose
ZwSetValueKey
wcslen
ZwQueryValueKey
ZwOpenKey
_except_handler3
ZwDeleteKey
swprintf
ZwCreateKey
wcsncpy
wcsrchr
PsGetVersion
KeQuerySystemTime
RtlCompareUnicodeString
_snwprintf
wcschr
ObReferenceObjectByHandle
ObfDereferenceObject
MmIsAddressValid
wcscat
wcscpy
strncpy
ExAllocatePoolWithTag
KeDelayExecutionThread
_wcsicmp
IoDeviceObjectType
PsCreateSystemThread
ZwSetInformationFile
ZwCreateFile
_wcsnicmp
PsLookupProcessByProcessId
_stricmp
ExFreePool
_snprintf
IofCompleteRequest
KeTickCount
KeQueryTimeIncrement
PsSetCreateProcessNotifyRoutine
MmGetSystemRoutineAddress
RtlAnsiStringToUnicodeString
IoRegisterDriverReinitialization
RtlCopyUnicodeString
wcsstr
_wcslwr
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 96B - Virtual size: 69B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ