Static task
static1
General
-
Target
69bf9d83cd75d327965a0be9313cb921_JaffaCakes118
-
Size
39KB
-
MD5
69bf9d83cd75d327965a0be9313cb921
-
SHA1
f612e1968fc5a0d7cdd3b94020577f02f3e1eab0
-
SHA256
93689d2e8ec7fe8febc73bc40d20cc11b8f945535bc2d7361e23fea215ba377d
-
SHA512
5d924846bfa6c2ea225a1b3590da61c5f56f41b04b7280f395774a84281ac17797dd21e92ded86243b5eb25c1efc194e48ea1c55588255f39c33679dcbd3c631
-
SSDEEP
768:NZFKduEOCf1cuRiVIqOdnir6pRAAyGtifnU1IgP4rLlu:NZFnEbCLWtdMGtifnU3P4rL8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 69bf9d83cd75d327965a0be9313cb921_JaffaCakes118
Files
-
69bf9d83cd75d327965a0be9313cb921_JaffaCakes118.sys windows:4 windows x86 arch:x86
1afb03857dbe8a265d4dfe33913b2aa0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitUnicodeString
RtlCopyUnicodeString
wcslen
ZwCreateKey
swprintf
wcsncpy
wcsrchr
_wcsnicmp
ObfDereferenceObject
_snwprintf
wcschr
_wcsicmp
RtlCompareUnicodeString
IoRegisterDriverReinitialization
ExAllocatePoolWithTag
ExFreePool
_snprintf
MmIsAddressValid
ZwSetValueKey
ZwClose
ZwQueryValueKey
ZwOpenKey
_except_handler3
ZwCreateFile
strncmp
IoGetCurrentProcess
wcsstr
_wcslwr
ObReferenceObjectByHandle
IofCompleteRequest
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsSetCreateProcessNotifyRoutine
PsGetVersion
ZwDeleteKey
KeTickCount
KeQueryTimeIncrement
_stricmp
MmGetSystemRoutineAddress
wcscat
wcscpy
RtlAnsiStringToUnicodeString
ZwSetInformationFile
KeDelayExecutionThread
KeQuerySystemTime
IoDeviceObjectType
strncpy
PsLookupProcessByProcessId
PsCreateSystemThread
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 61B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 5B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ