Static task
static1
General
-
Target
8579119b3728341d42b31c7ae459ceb4_JaffaCakes118
-
Size
22KB
-
MD5
8579119b3728341d42b31c7ae459ceb4
-
SHA1
0a2cf21d70a32eaec1540dc6261a32c69e697af7
-
SHA256
424104fa51436a177f6bf5c952cb9ddb43f68707f8478c73b3d8f069488a5d76
-
SHA512
cdaa882353d4ee4a79edcbf3ecc4da39d275736eb6bb68eb2965d9d7aacd2f98ecc8a65492f2b00c89c0ba72b4381dc37110c05049e3a67f93fa7868bfbc083f
-
SSDEEP
384:rSlXDnt/8zfCsSCZXH5fo4NlNr3+CH7228061yhKMg3P/bOXk6zjCeQ7EfiUZOab:rSlXjd8Ho4V+YS28TPyXdHaQXO06X+r
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8579119b3728341d42b31c7ae459ceb4_JaffaCakes118
Files
-
8579119b3728341d42b31c7ae459ceb4_JaffaCakes118.sys windows:5 windows x86 arch:x86
b42a6725d0c381dee9981c176640a672
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
swprintf
MmIsAddressValid
_snprintf
ExFreePool
ExAllocatePoolWithTag
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ZwUnmapViewOfSection
strncmp
IoGetCurrentProcess
_wcsnicmp
wcslen
PsTerminateSystemThread
KeDelayExecutionThread
PsCreateSystemThread
_stricmp
strncpy
PsLookupProcessByProcessId
KeInitializeTimer
IofCompleteRequest
RtlFreeUnicodeString
ZwCreateKey
wcscat
wcscpy
PsGetVersion
_wcslwr
wcsncpy
ZwCreateFile
ZwSetValueKey
ZwOpenKey
ZwEnumerateKey
IoRegisterDriverReinitialization
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 992B - Virtual size: 986B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 608B - Virtual size: 608B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ