Static task
static1
General
-
Target
66fb5e09465a09b62b6cca37e9098ea7_JaffaCakes118
-
Size
40KB
-
MD5
66fb5e09465a09b62b6cca37e9098ea7
-
SHA1
571b2efe02ddd169660cda3e44a724daaa7a7040
-
SHA256
9748bd44d639d35771f71c5f38b27092b4447c3b5932793a9706f0be3fcbb562
-
SHA512
daaa20412a09a911141c20f137eb6d36c905db390cb110a519a21a00963fa96371e01bd9088320238160caa3617f89e65b0388d1e49b1a21c589382a663a38d6
-
SSDEEP
768:pdqDKBqdjiWoLF5TlbRg7HPXdLNe6vPXAxodmatcGazlxZG:PIKBqdjivLgrfz3rwlGapxY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 66fb5e09465a09b62b6cca37e9098ea7_JaffaCakes118
Files
-
66fb5e09465a09b62b6cca37e9098ea7_JaffaCakes118.sys windows:4 windows x86 arch:x86
29feb94e02ed628813cc5c75a7e6ade9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlAnsiStringToUnicodeString
ZwClose
ZwQueryValueKey
RtlInitUnicodeString
ZwDeleteKey
swprintf
ZwOpenKey
ZwSetValueKey
ObReferenceObjectByHandle
strncmp
IoGetCurrentProcess
KeDelayExecutionThread
KeQuerySystemTime
IoRegisterDriverReinitialization
wcslen
wcscat
wcscpy
_wcsicmp
_except_handler3
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsSetCreateProcessNotifyRoutine
strncpy
PsLookupProcessByProcessId
_stricmp
MmIsAddressValid
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
PsCreateSystemThread
wcsncpy
wcsrchr
_snwprintf
KeTickCount
KeQueryTimeIncrement
_snprintf
wcsstr
_wcslwr
PsGetVersion
ZwCreateKey
MmGetSystemRoutineAddress
RtlCompareUnicodeString
IofCompleteRequest
wcschr
_wcsnicmp
IoDeviceObjectType
ZwCreateFile
RtlCopyUnicodeString
ZwSetInformationFile
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 51B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ