Static task
static1
General
-
Target
5c7e6118bcbf8ad5b76d51e5f8ebe89e_JaffaCakes118
-
Size
40KB
-
MD5
5c7e6118bcbf8ad5b76d51e5f8ebe89e
-
SHA1
42266d1b4d41f3c7f8434a4bfa8b3ba4b5e51705
-
SHA256
970770a203ed9b24fc497e547e8462f7b2cea0095285da2c25f2313b0a9e16d5
-
SHA512
1a38044adf70a66806bf1d777c5203cc866d7a54a5e6317eb573aaffadc88fa91c5fa7208136f8246bde0b0e13695a8d63d4ddaca20af8093353ed29afc52995
-
SSDEEP
768:uKuajxKjfSDT+YyiDk89JqKoQe0N2zDVTxxjFf+ylhIH3art:uK5Ku/xtDq4/2ddndY3ar
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5c7e6118bcbf8ad5b76d51e5f8ebe89e_JaffaCakes118
Files
-
5c7e6118bcbf8ad5b76d51e5f8ebe89e_JaffaCakes118.sys windows:4 windows x86 arch:x86
4ee33ed8771e299ed7606b4923a98a43
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
swprintf
ZwOpenKey
RtlInitUnicodeString
MmIsAddressValid
IoDeviceObjectType
strncmp
IoGetCurrentProcess
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ExFreePool
_snprintf
ExAllocatePoolWithTag
wcslen
wcscat
wcscpy
_wcsicmp
ZwQueryValueKey
_except_handler3
PsSetCreateProcessNotifyRoutine
IoRegisterDriverReinitialization
ZwCreateKey
wcsncpy
wcsrchr
ZwSetInformationFile
ZwCreateFile
ZwSetValueKey
ObfDereferenceObject
KeDelayExecutionThread
KeQuerySystemTime
wcsstr
_wcslwr
ObReferenceObjectByHandle
MmGetSystemRoutineAddress
_wcsnicmp
IofCompleteRequest
_snwprintf
wcschr
ZwDeleteKey
strncpy
RtlCopyUnicodeString
KeTickCount
KeQueryTimeIncrement
_stricmp
PsGetVersion
RtlAnsiStringToUnicodeString
PsCreateSystemThread
RtlCompareUnicodeString
PsLookupProcessByProcessId
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 64B - Virtual size: 47B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ