Static task
static1
General
-
Target
6ab2c20a7aa5db4194383a6eff75e44a_JaffaCakes118
-
Size
37KB
-
MD5
6ab2c20a7aa5db4194383a6eff75e44a
-
SHA1
98e042a9804a78d68137f817db324b7819c340bc
-
SHA256
91d08d337123d98f5a55d93bc70966ce789332d12b46c629354807c070d6a127
-
SHA512
0066a0d9b2a91722cd395d9f21607aa85cd5e7b6c034afbd6ebd9664d95647bb30fb740fb19f68c43f3e11366c0117695f3a3933f50dbdd986b896f47a934140
-
SSDEEP
768:0fbyn32G0D8bRX49MbjD/rH+faXss451bkcpKGflyGyYT/w7znSZ+ooXY7PO:0en50gbRPbX/rH+JhzbkcU6lyGyYT2Sr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6ab2c20a7aa5db4194383a6eff75e44a_JaffaCakes118
Files
-
6ab2c20a7aa5db4194383a6eff75e44a_JaffaCakes118.sys windows:4 windows x86 arch:x86
dce8b1a3d3f3cc932799778d4c428d3b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ObfDereferenceObject
MmIsAddressValid
ObReferenceObjectByHandle
ZwOpenKey
RtlInitUnicodeString
wcsncpy
wcsrchr
ZwDeleteKey
swprintf
_wcsicmp
wcslen
IofCompleteRequest
wcscat
wcscpy
ZwSetValueKey
wcsstr
_wcslwr
IoRegisterDriverReinitialization
RtlAnsiStringToUnicodeString
RtlCopyUnicodeString
strncpy
PsLookupProcessByProcessId
_stricmp
ZwQueryValueKey
ZwCreateKey
PsSetCreateProcessNotifyRoutine
ZwCreateFile
_except_handler3
KeQuerySystemTime
_wcsnicmp
_snwprintf
ExAllocatePoolWithTag
PsCreateSystemThread
ZwSetInformationFile
wcschr
KeTickCount
KeQueryTimeIncrement
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
KeDelayExecutionThread
IoDeviceObjectType
RtlCompareUnicodeString
ExFreePool
IoGetCurrentProcess
_snprintf
strncmp
MmGetSystemRoutineAddress
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 65B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 640B - Virtual size: 616B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ