Static task
static1
General
-
Target
a35420c489a39277a1b9ba3f121e7ae4_JaffaCakes118
-
Size
8KB
-
MD5
a35420c489a39277a1b9ba3f121e7ae4
-
SHA1
e6e9d21b08e8e67dea2478ea45a05f7be00693af
-
SHA256
f7e54861a7bf85596740e99c62cfd0fd705cc4578508d9a2e8e45a8fbc21f97c
-
SHA512
8b0a2c15f31b4c8aa2d04aec1a9e3cb8d0fb441a76f531a3ca31b731497f42c116f627d87c3f3561b8e60ec80ca051648b4c7a06bcff54b212709b48a7de476d
-
SSDEEP
192:TtOEFxUPhWgQTNMhYr4kieUPwmlXsMXpCvv/Yb:RChqZM04HngAb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a35420c489a39277a1b9ba3f121e7ae4_JaffaCakes118
Files
-
a35420c489a39277a1b9ba3f121e7ae4_JaffaCakes118.sys windows:5 windows x86 arch:x86
a19ab3575b84da43938b4d66e847cd2a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_stricmp
IoGetCurrentProcess
ZwClose
ZwUnmapViewOfSection
strncmp
PsGetVersion
strncpy
DbgPrint
ObfDereferenceObject
KeDetachProcess
KeAttachProcess
PsLookupProcessByProcessId
_except_handler3
IoDeleteDevice
IoDeleteSymbolicLink
ZwQuerySystemInformation
RtlFreeAnsiString
RtlCompareMemory
RtlInitAnsiString
RtlUnicodeStringToAnsiString
IoCreateSymbolicLink
IoCreateDevice
IofCompleteRequest
wcscmp
ZwDeviceIoControlFile
ZwQueryDirectoryFile
wcslen
ZwEnumerateKey
ZwCreateKey
ZwSetValueKey
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
RtlAnsiStringToUnicodeString
ExAllocatePoolWithTag
strncat
RtlInitUnicodeString
ExFreePool
hal
KfRaiseIrql
KfLowerIrql
KeGetCurrentIrql
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 320B - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 192B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 576B - Virtual size: 564B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ