Static task
static1
General
-
Target
a993182a96c18d2d94adf0b827d7fc92_JaffaCakes118
-
Size
40KB
-
MD5
a993182a96c18d2d94adf0b827d7fc92
-
SHA1
fd81f47fc578e55755ad2392c0742de372e99faf
-
SHA256
a1e58c5b15fc89386be78be8b4564485f4f4fa97b253b0488c862bd92cf9b6a3
-
SHA512
eab6eaa9c86b662af88f115a4b1b5e2f9cb63ec43077c1f87c4e64b9600bd64fcc3679c0cfcca6487ebdcaddae6208c02f329aafe8661f852bc071ffde051c48
-
SSDEEP
768:RnqsLIQiM3Cn0zJY55cS002UBe5XRj9MyuI6TCLbTzsG2KbMgXnAuQ5o:RnqsLIQJyn0zJa54023l9MlI6mLTsiXW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a993182a96c18d2d94adf0b827d7fc92_JaffaCakes118
Files
-
a993182a96c18d2d94adf0b827d7fc92_JaffaCakes118.sys windows:4 windows x86 arch:x86
888d2645928d8905e6232983ff408ef7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ObfDereferenceObject
IoRegisterDriverReinitialization
MmGetSystemRoutineAddress
RtlInitUnicodeString
ZwClose
ZwDeleteKey
swprintf
_stricmp
wcsstr
_wcslwr
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ZwQueryValueKey
ZwOpenKey
PsGetVersion
_wcsicmp
wcsncpy
wcslen
wcsrchr
PsCreateSystemThread
MmIsAddressValid
ObReferenceObjectByHandle
_snwprintf
wcschr
strncpy
PsLookupProcessByProcessId
RtlAnsiStringToUnicodeString
ExFreePool
ExAllocatePoolWithTag
_wcsnicmp
KeTickCount
KeQueryTimeIncrement
IofCompleteRequest
ZwSetValueKey
RtlCompareUnicodeString
KeDelayExecutionThread
KeQuerySystemTime
_except_handler3
strncmp
IoGetCurrentProcess
RtlCopyUnicodeString
ZwSetInformationFile
ZwCreateFile
wcscpy
ZwCreateKey
PsSetCreateProcessNotifyRoutine
wcscat
IoDeviceObjectType
_snprintf
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 72B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 5B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ