Static task
static1
General
-
Target
b0c9594efd3be9f7c736b70770d4fc19_JaffaCakes118
-
Size
40KB
-
MD5
b0c9594efd3be9f7c736b70770d4fc19
-
SHA1
09679df028d3ea0ae97b2b00ab44ebfd88838a46
-
SHA256
4095569ba2be2767a0ac2c0428104f71b4d9abbef62c68ab7fa94ac0a98e060c
-
SHA512
b0694b8fe2ca91430411ca3d955cc3478eafa94fcf9d74e6cd451eb2bed322a41af27228d65ad6c23bf10b6775db17039a8fefc972edcaa14d97124536f18d1e
-
SSDEEP
768:clOQVRTN9mam8GjLksgT/hftmACqi2gjMefK8wRPISE8JyXHCH:clOQx9X5GjL7gTZftmCiDQefKzRPbE8Y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b0c9594efd3be9f7c736b70770d4fc19_JaffaCakes118
Files
-
b0c9594efd3be9f7c736b70770d4fc19_JaffaCakes118.sys windows:4 windows x86 arch:x86
a888e7d652250d9608d83ede1f35808a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
PsGetVersion
wcsstr
_wcslwr
strncpy
IoGetCurrentProcess
ZwSetInformationFile
ZwCreateFile
RtlInitUnicodeString
wcslen
wcscpy
swprintf
ZwSetValueKey
ZwQueryValueKey
ZwOpenKey
_except_handler3
PsCreateSystemThread
_wcsicmp
ObReferenceObjectByHandle
RtlCopyUnicodeString
wcscat
wcsncpy
wcsrchr
MmIsAddressValid
PsLookupProcessByProcessId
_stricmp
PsSetCreateProcessNotifyRoutine
KeTickCount
KeQueryTimeIncrement
strncmp
IoRegisterDriverReinitialization
RtlAnsiStringToUnicodeString
MmGetSystemRoutineAddress
IoDeviceObjectType
KeQuerySystemTime
_wcsnicmp
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ObfDereferenceObject
ZwDeleteKey
ZwCreateKey
ExFreePool
ExAllocatePoolWithTag
_snwprintf
RtlCompareUnicodeString
wcschr
_snprintf
KeDelayExecutionThread
IofCompleteRequest
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 59B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ