Static task
static1
General
-
Target
6046844ce72fe347e83c535b8a2bdb43_JaffaCakes118
-
Size
40KB
-
MD5
6046844ce72fe347e83c535b8a2bdb43
-
SHA1
52a5fe92bd098b5752ce8359ded2ffc28e2b1524
-
SHA256
8a0beb8be615111b6e1355895edbfbf69ca1ea2411053559386b3cc41df528df
-
SHA512
4a3430c45282ad0c379b307b68c6e74abee8b70c05342e3b8ce731249f8998fc25bd2ab1be1dddb1d8bc744eb75b90ec3c72850a95716aaaaa774ecb7a4c0c1d
-
SSDEEP
768:GZ/rAtS5l8o51jsdMzAdEKm4Vs9yA4vJ149efdWh8HzYozkxP/erriXWIa:GZUtBMzRKfa9KKoFWqTpzk1/zL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6046844ce72fe347e83c535b8a2bdb43_JaffaCakes118
Files
-
6046844ce72fe347e83c535b8a2bdb43_JaffaCakes118.sys windows:4 windows x86 arch:x86
4abc3c7a0cc72f023089db28f291b3e0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_snwprintf
wcsncpy
wcslen
wcschr
RtlCopyUnicodeString
RtlCompareUnicodeString
RtlInitUnicodeString
KeTickCount
KeQueryTimeIncrement
_stricmp
ZwClose
PsGetVersion
swprintf
wcsstr
_wcslwr
IofCompleteRequest
KeDelayExecutionThread
KeQuerySystemTime
strncmp
IoGetCurrentProcess
ObReferenceObjectByHandle
ZwSetValueKey
ZwQueryValueKey
ZwOpenKey
_except_handler3
_wcsicmp
wcsrchr
ExFreePool
_snprintf
ExAllocatePoolWithTag
ZwCreateKey
ZwDeleteKey
MmIsAddressValid
PsCreateSystemThread
PsSetCreateProcessNotifyRoutine
strncpy
PsLookupProcessByProcessId
_wcsnicmp
ObfDereferenceObject
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ZwSetInformationFile
ZwCreateFile
wcscpy
wcscat
RtlAnsiStringToUnicodeString
IoRegisterDriverReinitialization
MmGetSystemRoutineAddress
IoDeviceObjectType
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 72B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEALL Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDATA Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGECODE Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ