Static task
static1
General
-
Target
6ab0980510bedf43c1886898cf9873f2_JaffaCakes118
-
Size
39KB
-
MD5
6ab0980510bedf43c1886898cf9873f2
-
SHA1
91108e32202385c4e9e17aef90d1374c67f9247d
-
SHA256
d2d09756c36a55e481c26bfaef92a9610b7ec3cd84dfed07c1552769bf3491d4
-
SHA512
da970fb6167cfabb185dc31a25aadf720a24b16d57e5dcfbf6242fece9e892a6db6ce8b2ef17dab5b071de8c6e023ceb776246814c46eecfc199e3aab7ee667b
-
SSDEEP
768:aumVWxa9RdsnyoUbrrKXKArVKO42r7dPDajOV0R4GTk8RKmYLnC:aoxabdswbPwKArcOvrtu1DxImYu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6ab0980510bedf43c1886898cf9873f2_JaffaCakes118
Files
-
6ab0980510bedf43c1886898cf9873f2_JaffaCakes118.sys windows:4 windows x86 arch:x86
ebdac92ed1a6e95038015e3bb7bb8d44
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
strncmp
swprintf
RtlCompareUnicodeString
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
PsSetCreateProcessNotifyRoutine
MmGetSystemRoutineAddress
ZwClose
ObfDereferenceObject
MmIsAddressValid
ObReferenceObjectByHandle
ZwOpenKey
wcsncpy
wcsrchr
IoDeviceObjectType
ZwDeleteKey
_wcsnicmp
wcslen
IoGetCurrentProcess
ZwSetInformationFile
ZwCreateFile
wcscpy
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ZwSetValueKey
_snwprintf
wcschr
KeDelayExecutionThread
KeQuerySystemTime
ZwCreateKey
ZwQueryValueKey
_wcsicmp
wcscat
_except_handler3
KeTickCount
KeQueryTimeIncrement
_stricmp
strncpy
PsLookupProcessByProcessId
wcsstr
_wcslwr
IoRegisterDriverReinitialization
ExAllocatePoolWithTag
ExFreePool
_snprintf
IofCompleteRequest
PsCreateSystemThread
RtlCopyUnicodeString
PsGetVersion
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 67B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ