Static task
static1
General
-
Target
94880366b18ce3ab36839f2793d4e583_JaffaCakes118
-
Size
40KB
-
MD5
94880366b18ce3ab36839f2793d4e583
-
SHA1
8092cef37aa48040d5202429fbd50e893f42a427
-
SHA256
c677a5a6e11b08ec2fed5ba1bf95801b85b8e3bb47f3103e0c3ac11ace225119
-
SHA512
f43b3e8c7daa89fd7799293fffefe8b47a3423c61a942cc9c0c098ba7c9c4076925702eebcb992a2a9b98d682c9a9ef252b243d772e6bd949ee8ef73a1e8f09d
-
SSDEEP
768:htZ0Yb0B8GVUNOaR+vtx+kb0Mnvs8Zs9rQG3ihh8AE+wqImztaDifw/PTe3:fZ0u0aGVUgzvtxr0WvfZs90GyhKSwqIR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 94880366b18ce3ab36839f2793d4e583_JaffaCakes118
Files
-
94880366b18ce3ab36839f2793d4e583_JaffaCakes118.sys windows:4 windows x86 arch:x86
5226467e45c799d3ab1e258dd2935ba0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwQueryValueKey
RtlInitUnicodeString
MmIsAddressValid
wcslen
wcscat
wcscpy
_wcsicmp
ZwOpenKey
_except_handler3
ZwSetValueKey
ZwCreateKey
wcsstr
_wcslwr
PsGetVersion
ZwDeleteKey
swprintf
_snwprintf
wcsncpy
wcschr
_wcsnicmp
wcsrchr
_stricmp
ZwCreateFile
KeQuerySystemTime
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
ObReferenceObjectByHandle
ZwSetInformationFile
RtlCopyUnicodeString
KeTickCount
KeQueryTimeIncrement
IoDeviceObjectType
IofCompleteRequest
IoGetCurrentProcess
RtlAnsiStringToUnicodeString
strncmp
MmGetSystemRoutineAddress
PsCreateSystemThread
_snprintf
strncpy
RtlCompareUnicodeString
PsLookupProcessByProcessId
KeDelayExecutionThread
IoRegisterDriverReinitialization
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 66B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ