Static task
static1
General
-
Target
9490f5c97941af73087b3b1089dd2050_JaffaCakes118
-
Size
41KB
-
MD5
9490f5c97941af73087b3b1089dd2050
-
SHA1
760253c5c969345914b09cdb9fa393f53164e19d
-
SHA256
c5390d787aab60d6e513f1c5a9f852013988f7659abe81b77f48b87772270dd4
-
SHA512
55fef247c2b6480253afded6b7082ab9eaaad8edddb988b1ddb19027a0440f858d15a7f6872b749571a41d4111c69b48c1d3c1469ef3b1f458a277f8d08c1177
-
SSDEEP
768:5leqz2eJy6+LqtiqrdAFcZqrc0gYPORJOTSG6+bYEkCwCCNwCT80OhG:5l5z2eA6+OtionZkzgcIJ8bYEkvCPCTg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9490f5c97941af73087b3b1089dd2050_JaffaCakes118
Files
-
9490f5c97941af73087b3b1089dd2050_JaffaCakes118.sys windows:4 windows x86 arch:x86
9c6cb4b29a8885d730050d6e60ca5b25
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
wcsstr
_wcslwr
ZwClose
ZwOpenKey
RtlInitUnicodeString
_stricmp
swprintf
ZwDeleteKey
ZwQueryValueKey
wcslen
wcscat
wcscpy
_wcsicmp
_except_handler3
ObfDereferenceObject
strncpy
PsLookupProcessByProcessId
IoGetCurrentProcess
wcsncpy
wcsrchr
ZwSetValueKey
ObReferenceObjectByHandle
ExFreePool
ExAllocatePoolWithTag
RtlCompareUnicodeString
_wcsnicmp
MmIsAddressValid
PsGetVersion
PsSetCreateProcessNotifyRoutine
KeDelayExecutionThread
KeQuerySystemTime
IofCompleteRequest
MmGetSystemRoutineAddress
strncmp
ZwCreateFile
_snprintf
IoDeviceObjectType
KeTickCount
KeQueryTimeIncrement
IoRegisterDriverReinitialization
RtlCopyUnicodeString
ZwSetInformationFile
ZwCreateKey
RtlAnsiStringToUnicodeString
_snwprintf
PsCreateSystemThread
wcschr
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 41B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEALL Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ