Static task
static1
General
-
Target
76bb4e09dd9ef5edab58662c05451200_JaffaCakes118
-
Size
41KB
-
MD5
76bb4e09dd9ef5edab58662c05451200
-
SHA1
6aacc2f06f2e8fa5e17d48b8884b8f1a2be07514
-
SHA256
1c1cc85aa61c2bbebee645e18f210bc6b2e41d9877acbef44dd3923cf8d77ab7
-
SHA512
5f968e1954b14cebce24be352b03a68b2decea6a4b87e71b7e4caa0333ef60a74e8b9e010b78eabfb3bedf243106302dc2d19fb896d8d0ec1eb63fb2a1c95f42
-
SSDEEP
768:ycWw2JAXtw10sYDCz+EjCAZLO9BBpUSLNsnBb2Ro5Z8d0XvH0U6:dP2Gw10sYa+KCAZqTLoG0XvU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 76bb4e09dd9ef5edab58662c05451200_JaffaCakes118
Files
-
76bb4e09dd9ef5edab58662c05451200_JaffaCakes118.sys windows:4 windows x86 arch:x86
1da897a3809e35fd89e1ee4b46d78b09
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
MmGetSystemRoutineAddress
RtlInitUnicodeString
ZwClose
ZwQueryValueKey
KeDelayExecutionThread
KeQuerySystemTime
wcsncpy
MmIsAddressValid
IoGetCurrentProcess
PsGetVersion
swprintf
ZwOpenKey
wcslen
wcscat
wcscpy
ZwCreateFile
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
_snwprintf
strncpy
PsLookupProcessByProcessId
_stricmp
wcsstr
_wcslwr
ZwDeleteKey
_snprintf
ZwSetValueKey
_wcsicmp
_except_handler3
RtlAnsiStringToUnicodeString
ObReferenceObjectByHandle
wcschr
RtlCopyUnicodeString
RtlCompareUnicodeString
IofCompleteRequest
strncmp
PsSetCreateProcessNotifyRoutine
wcsrchr
IoDeviceObjectType
_wcsnicmp
ZwSetInformationFile
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsCreateSystemThread
ZwCreateKey
IoRegisterDriverReinitialization
KeTickCount
KeQueryTimeIncrement
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 53B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEALL Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDATA Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ