Static task
static1
General
-
Target
8dca52f39f04e16c19719184accab56b_JaffaCakes118
-
Size
40KB
-
MD5
8dca52f39f04e16c19719184accab56b
-
SHA1
2578f14d85c9a621715fdb4551dcc527b6c9f81f
-
SHA256
1f3f4aabdf30a46697d0afe6ea00ba161bca4b4f953e76f9869df4f5b17084c9
-
SHA512
6925ad9b7602c477929ea83d5fcaf5454deb997801a81a8117d06b8d7b6ea35852e59a1d843de99f45c10e96862887e3e2850a1c25bf9647a0a0970dc0d182ab
-
SSDEEP
768:oWDl1pwHcOUaHgQTB/RkOW9xaCnpy/yzt7aADETdzeb72EjXPRMf5EuEVBQ+:vrtTQ1s7pnzteLTkH2Ej/R0E8+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8dca52f39f04e16c19719184accab56b_JaffaCakes118
Files
-
8dca52f39f04e16c19719184accab56b_JaffaCakes118.sys windows:4 windows x86 arch:x86
54abb6a5d182247c63783c5553303d44
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
wcslen
wcscat
wcscpy
_wcsicmp
ZwClose
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_except_handler3
RtlCopyUnicodeString
wcsstr
_wcslwr
strncpy
IoGetCurrentProcess
ZwCreateFile
swprintf
ZwSetValueKey
ObReferenceObjectByHandle
_stricmp
MmIsAddressValid
ExFreePool
_snprintf
ExAllocatePoolWithTag
RtlCompareUnicodeString
IoDeviceObjectType
PsLookupProcessByProcessId
IoRegisterDriverReinitialization
PsGetVersion
_snwprintf
wcsncpy
wcschr
PsSetCreateProcessNotifyRoutine
ObfDereferenceObject
ZwSetInformationFile
PsCreateSystemThread
KeDelayExecutionThread
KeQuerySystemTime
strncmp
ZwCreateKey
wcsrchr
ZwDeleteKey
RtlAnsiStringToUnicodeString
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
KeQueryTimeIncrement
IofCompleteRequest
_wcsnicmp
MmGetSystemRoutineAddress
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 66B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ