Static task
static1
General
-
Target
5f457e386ce091eb71289102bad25bc9_JaffaCakes118
-
Size
15KB
-
MD5
5f457e386ce091eb71289102bad25bc9
-
SHA1
4c299f432216dec1746503f5cbe3cc5e43ec7387
-
SHA256
84cd5b890f119abb33ca37d1d6428a02fd8f7510ca75dbdffb0d2458d089d7b6
-
SHA512
21b279d07f8b30b5650a28c06cfa08a374fe0aa3d3fd9e1c3e80744ee041dcc43d983677d44c9d00789124c7e58a316912f57748f45b5c89ce367ddaa99bc6a8
-
SSDEEP
192:C1IMn1GKjJgel0VVsDPrtcpsfjcmxQaPqndyQJdEer/wd0pUKvPJzW:eIMsSgA0HsbrtcpqSnd5JGeEenP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5f457e386ce091eb71289102bad25bc9_JaffaCakes118
Files
-
5f457e386ce091eb71289102bad25bc9_JaffaCakes118.sys windows:4 windows x86 arch:x86
308b4551244f2687791fce6838e06366
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
_snprintf
ZwCreateFile
RtlInitUnicodeString
_snwprintf
PsTerminateSystemThread
KeDelayExecutionThread
_allmul
IoDeleteDevice
IoDeleteSymbolicLink
ExFreePoolWithTag
IofCompleteRequest
MmMapLockedPagesSpecifyCache
ExAllocatePoolWithTag
PsCreateSystemThread
IoCreateSymbolicLink
IoCreateDevice
strchr
atoi
wcstombs
ZwWaitForSingleObject
ZwEnumerateKey
ZwQueryValueKey
wcscat
wcslen
ZwOpenKey
wcscpy
KeServiceDescriptorTable
ZwSetValueKey
MmIsAddressValid
KeAddSystemServiceTable
wcscmp
ZwQuerySystemInformation
ZwFreeVirtualMemory
KeUserModeCallback
ZwAllocateVirtualMemory
ZwQueryInformationProcess
KeDetachProcess
KeAttachProcess
PsLookupProcessByProcessId
KeClearEvent
KeSetEvent
PsGetCurrentProcessId
KeWaitForSingleObject
NtBuildNumber
KeInitializeEvent
ZwDeleteFile
ZwWriteFile
strstr
ObfDereferenceObject
ObReferenceObjectByHandle
IofCallDriver
IoBuildDeviceIoControlRequest
IoGetRelatedDeviceObject
IoFreeMdl
MmProbeAndLockPages
IoFreeIrp
IoAllocateMdl
_except_handler3
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 416B - Virtual size: 412B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 576B - Virtual size: 568B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 960B - Virtual size: 942B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ