Static task
static1
General
-
Target
a2fb0c1e098dfd8d39c7852b34d3c82a_JaffaCakes118
-
Size
39KB
-
MD5
a2fb0c1e098dfd8d39c7852b34d3c82a
-
SHA1
d572b3133db7cc37416f6ba09021afee027f460f
-
SHA256
662bb6cdcf04216a547304b4477c62e5679ee7eeb2c9cd4ab44c9c4165c274f3
-
SHA512
a7709bba728179303fd8f773ce39ae20f9fd3605d8c7af815cae9d3e018e191b81c56f2af9a9c2a04c025b9e7d9eb9a4836d9801bc620c4fa840925671bce003
-
SSDEEP
768:G3i44WKRPt7LVZnqNQBdxCPNka0/JBC8k8shDouFdux/6eyQ:G3i4xaPtPn7BPCShBdk9DouFm/MQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a2fb0c1e098dfd8d39c7852b34d3c82a_JaffaCakes118
Files
-
a2fb0c1e098dfd8d39c7852b34d3c82a_JaffaCakes118.sys windows:4 windows x86 arch:x86
df6fa421cc482af032a3a7a239732d9d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitUnicodeString
_wcsnicmp
wcslen
RtlCompareUnicodeString
ZwClose
ZwSetValueKey
ZwQueryValueKey
ZwOpenKey
_except_handler3
KeTickCount
KeQueryTimeIncrement
_stricmp
ZwCreateFile
swprintf
strncpy
IoGetCurrentProcess
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
RtlAnsiStringToUnicodeString
PsCreateSystemThread
wcscat
wcscpy
_wcsicmp
_snprintf
MmIsAddressValid
strncmp
ZwDeleteKey
KeDelayExecutionThread
KeQuerySystemTime
MmGetSystemRoutineAddress
_snwprintf
ObReferenceObjectByHandle
ZwSetInformationFile
ZwCreateKey
wcsncpy
wcsrchr
wcsstr
_wcslwr
wcschr
PsGetVersion
PsSetCreateProcessNotifyRoutine
IofCompleteRequest
RtlCopyUnicodeString
PsLookupProcessByProcessId
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IoDeviceObjectType
IoRegisterDriverReinitialization
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 73B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ