Static task
static1
General
-
Target
83c6b7e32bb75e27d56464ed7221a170_JaffaCakes118
-
Size
40KB
-
MD5
83c6b7e32bb75e27d56464ed7221a170
-
SHA1
7da5523dbe69ed9e83ccf1c58865ea64b0969821
-
SHA256
9bcba1e513253ffd13a57707b46ac20b0207ccd30e3a9fbf7b8b62d2fe593372
-
SHA512
f58936a356ff1d5cce44569b04128c65cb43027dacd78e6dc144c46d66eed61015a4c35ddddb6f3327acbc039fb55fbcb34c9ed37acbb02a942a241168abe870
-
SSDEEP
768:9DVRKh2cn2SB8c9Ybx0gbcu1K3Qakfc3FRQ1VxUmBMtYOfF1dBKCp:9Fcnp6GYbW4akfiRQFUmBMtNfNBK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 83c6b7e32bb75e27d56464ed7221a170_JaffaCakes118
Files
-
83c6b7e32bb75e27d56464ed7221a170_JaffaCakes118.sys windows:4 windows x86 arch:x86
9e121be2c2a457f7a5619e05f3caf9e4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
swprintf
ZwOpenKey
RtlInitUnicodeString
PsGetVersion
ZwSetValueKey
ZwQueryValueKey
wcslen
_except_handler3
MmIsAddressValid
KeDelayExecutionThread
KeQuerySystemTime
ZwCreateKey
wcsstr
_wcslwr
ZwDeleteKey
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
strncpy
IoGetCurrentProcess
strncmp
RtlCompareUnicodeString
wcsncpy
_wcsnicmp
IofCompleteRequest
_snprintf
RtlAnsiStringToUnicodeString
wcsrchr
PsCreateSystemThread
ZwSetInformationFile
ZwCreateFile
wcscpy
MmGetSystemRoutineAddress
IoRegisterDriverReinitialization
_snwprintf
wcschr
ObReferenceObjectByHandle
PsSetCreateProcessNotifyRoutine
_stricmp
PsLookupProcessByProcessId
wcscat
_wcsicmp
KeTickCount
KeQueryTimeIncrement
IoDeviceObjectType
RtlCopyUnicodeString
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 5B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 96B - Virtual size: 68B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ