Static task
static1
General
-
Target
7034aa299b39e9164e6aa35270a79bf2_JaffaCakes118
-
Size
40KB
-
MD5
7034aa299b39e9164e6aa35270a79bf2
-
SHA1
9ad1a76551f59760e01cbae6092502229c26282f
-
SHA256
46b54fec78aca1a07640921e51d9642382048c3fbd4d0987a184fd891ee31671
-
SHA512
3bcfe26f31516f6fbf6484e51b381e0fd4a94a4a8c6d02df89f2a4c55c90f0bda69b3adcf3ad759b0c6ab6859d359288d46c36158cbef8b555a09469015ec0d8
-
SSDEEP
768:pWyQzElVgGKAJ0x8qHWzr5v7HR8KJD7gk8tvP6Whd:7WELgPAJI8Jzr5v7HR80R8tvPl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7034aa299b39e9164e6aa35270a79bf2_JaffaCakes118
Files
-
7034aa299b39e9164e6aa35270a79bf2_JaffaCakes118.sys windows:4 windows x86 arch:x86
eae0aa91d4b4f178dd7effa52cf2089c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
wcslen
ZwCreateKey
RtlInitUnicodeString
swprintf
wcsncpy
wcsrchr
KeQuerySystemTime
IoRegisterDriverReinitialization
ZwClose
PsCreateSystemThread
PsGetVersion
ExFreePool
_snprintf
ExAllocatePoolWithTag
_wcsnicmp
ObfDereferenceObject
wcsstr
_wcslwr
PsSetCreateProcessNotifyRoutine
MmIsAddressValid
IoDeviceObjectType
ZwQueryValueKey
_snwprintf
ZwOpenKey
ZwSetValueKey
strncmp
IoGetCurrentProcess
IofCompleteRequest
ObReferenceObjectByHandle
ZwCreateFile
strncpy
PsLookupProcessByProcessId
_stricmp
_except_handler3
ZwDeleteKey
MmGetSystemRoutineAddress
wcscat
wcscpy
_wcsicmp
RtlCompareUnicodeString
wcschr
RtlCopyUnicodeString
RtlAnsiStringToUnicodeString
KeDelayExecutionThread
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
KeQueryTimeIncrement
ZwSetInformationFile
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 53B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ