Static task
static1
General
-
Target
5f813da7478b0fb59b9df2bf76081719_JaffaCakes118
-
Size
39KB
-
MD5
5f813da7478b0fb59b9df2bf76081719
-
SHA1
908cd6e946d3f7e1c0896cf35d12a2ad748a1924
-
SHA256
5f61f5dcfb1c2967dba7a71aa59d729f8dcef1339dd4703f5bd336816c3f2c2a
-
SHA512
de72f42c3b7cec2459d7db90f306bef923ef343efcc12d53f38704532520587653b1106a41a634cee8f60ec446e6af729679799babe65413fc3473637edd4dfd
-
SSDEEP
768:d/NqC8T3HYM7F0rQgtEqd0W6Nlqs1NMcBG7AtsrXOTO6Dj3Pc+7mEbwFGl:dr8T3arQg1+HPn1iG8iszmBn3PcdJY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5f813da7478b0fb59b9df2bf76081719_JaffaCakes118
Files
-
5f813da7478b0fb59b9df2bf76081719_JaffaCakes118.sys windows:4 windows x86 arch:x86
cf21cc77c5fdc45ebba3197dac3ad32f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_wcsnicmp
wcslen
_wcsicmp
ObReferenceObjectByHandle
KeDelayExecutionThread
KeQuerySystemTime
strncpy
PsLookupProcessByProcessId
_stricmp
swprintf
wcsstr
_wcslwr
ZwClose
ZwDeleteKey
ZwSetValueKey
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
MmGetSystemRoutineAddress
ObfDereferenceObject
PsCreateSystemThread
ZwQueryValueKey
ZwCreateKey
wcsncpy
wcsrchr
RtlAnsiStringToUnicodeString
PsGetVersion
_snwprintf
ExAllocatePoolWithTag
ZwCreateFile
ZwOpenKey
ExFreePool
_except_handler3
MmIsAddressValid
IoDeviceObjectType
wcscat
wcscpy
IoRegisterDriverReinitialization
RtlCopyUnicodeString
RtlCompareUnicodeString
PsSetCreateProcessNotifyRoutine
wcschr
ZwSetInformationFile
KeTickCount
KeQueryTimeIncrement
strncmp
_snprintf
IofCompleteRequest
IoGetCurrentProcess
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 75B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ