Static task
static1
General
-
Target
a21d527c012eaa22d5c1293d319bfc84_JaffaCakes118
-
Size
40KB
-
MD5
a21d527c012eaa22d5c1293d319bfc84
-
SHA1
ecfe2d96bb059bceb571f3091288823e95e5a316
-
SHA256
c1f4c52f14d3b09974a6fcfd907df91f909d76fd78e5a6fe68a0dec7dc47cec4
-
SHA512
f5f9a5d8dbf9b789e8d4163ad5e9433bb17775ea3bd057044bc993adf8af843a8498bdc31395827c11afb32395de69e35ccc0f523a6554814e5fee6c4965af55
-
SSDEEP
768:NVKv/mwVZTdj5RiwyL+c1+JRkn+kDU0WOEjFvEv0fL4qfS7Ak:3Kv+KpnR1cd1+JRk+kHYjVM0kqfS7H
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a21d527c012eaa22d5c1293d319bfc84_JaffaCakes118
Files
-
a21d527c012eaa22d5c1293d319bfc84_JaffaCakes118.sys windows:4 windows x86 arch:x86
12511dce15beb0ee9b3a5d3521372ec4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwSetValueKey
wcslen
ZwClose
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_except_handler3
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
PsCreateSystemThread
_wcsnicmp
RtlCompareUnicodeString
IofCompleteRequest
_stricmp
swprintf
wcsstr
_wcslwr
RtlAnsiStringToUnicodeString
_snprintf
ZwDeleteKey
MmGetSystemRoutineAddress
IoRegisterDriverReinitialization
ZwCreateKey
wcsncpy
wcsrchr
PsGetVersion
strncpy
PsLookupProcessByProcessId
wcscat
wcscpy
KeDelayExecutionThread
KeQuerySystemTime
ObReferenceObjectByHandle
_wcsicmp
MmIsAddressValid
IoGetCurrentProcess
strncmp
RtlCopyUnicodeString
_snwprintf
wcschr
IoDeviceObjectType
KeTickCount
KeQueryTimeIncrement
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ZwSetInformationFile
ZwCreateFile
PsSetCreateProcessNotifyRoutine
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 55B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ