Static task
static1
General
-
Target
89489c75cb387b40a60cdb84a393fadf_JaffaCakes118
-
Size
40KB
-
MD5
89489c75cb387b40a60cdb84a393fadf
-
SHA1
278bb748cd31b44cb7e8b88a1460c1a15cfad377
-
SHA256
b102f8095c27416a8a9562d70d76284aabcc74a14bbe1d25e8138836081d0910
-
SHA512
4b45ee80861dccaf9bc0e142f93987bdc72b20f2eb60d34d79aae8c56741e8f648b9a8e5cae3718d1fb95a26df7d8da1320cfe236a74fb551f284ae93aabb376
-
SSDEEP
768:82wlDcyAZ8jJibY93HbUoXEYsSsThMhthd2BL9lAV1YRDcFw96I1F:vwlD4YNooUYKThMhf8ZA0RDJF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 89489c75cb387b40a60cdb84a393fadf_JaffaCakes118
Files
-
89489c75cb387b40a60cdb84a393fadf_JaffaCakes118.sys windows:4 windows x86 arch:x86
4224db59b4377ad74f767f7e840a3eee
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
swprintf
ZwOpenKey
_wcsnicmp
wcslen
PsSetCreateProcessNotifyRoutine
_snwprintf
wcsncpy
wcschr
wcscat
wcscpy
RtlInitUnicodeString
MmIsAddressValid
ZwSetValueKey
ZwQueryValueKey
_except_handler3
strncpy
IoGetCurrentProcess
PsGetVersion
ObfDereferenceObject
RtlCopyUnicodeString
ZwCreateKey
wcsrchr
IoRegisterDriverReinitialization
KeTickCount
KeQueryTimeIncrement
_stricmp
ObReferenceObjectByHandle
RtlCompareUnicodeString
_wcsicmp
strncmp
ExFreePool
_snprintf
ExAllocatePoolWithTag
ZwDeleteKey
PsCreateSystemThread
ZwCreateFile
KeDelayExecutionThread
KeQuerySystemTime
ZwSetInformationFile
IofCompleteRequest
wcsstr
_wcslwr
RtlAnsiStringToUnicodeString
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
MmGetSystemRoutineAddress
PsLookupProcessByProcessId
IoDeviceObjectType
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 57B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ