Static task
static1
General
-
Target
b74a4c765eee9674245a6b402106df5c_JaffaCakes118
-
Size
40KB
-
MD5
b74a4c765eee9674245a6b402106df5c
-
SHA1
e8df26d91c3b23e9276f4c9fea248736b11cd631
-
SHA256
ea7319f47ebb60acdee05e5dc4283c3b5a2f4b12c51643b61efee171c7e560cc
-
SHA512
a325ffa6d6f5f17e58ce7128df393c4756fba8334c2bd64aebc715685b8de47460b4c54492dfdb732ed8c36dadda4ddf2905d62144d6674b8a506e29b9da75ba
-
SSDEEP
768:oFEiVyJNqfnRlLrsDi9xLsRhKAFZUmlCc/Zx/Wsu2ao8Ov+HuBlCzALBrsbfV6cS:+/sfqfRlv6i9xLsRhKAFZU0/Zx+suX1y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b74a4c765eee9674245a6b402106df5c_JaffaCakes118
Files
-
b74a4c765eee9674245a6b402106df5c_JaffaCakes118.sys windows:4 windows x86 arch:x86
0a5a51a4b8fe2de7798d2df14946783c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
strncpy
IoGetCurrentProcess
swprintf
ObfDereferenceObject
wcslen
wcscat
wcscpy
_wcsicmp
ZwClose
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_except_handler3
PsSetCreateProcessNotifyRoutine
ZwSetValueKey
ZwSetInformationFile
ZwCreateFile
_wcsnicmp
ZwDeleteKey
MmIsAddressValid
RtlAnsiStringToUnicodeString
RtlCopyUnicodeString
IofCompleteRequest
wcsstr
_wcslwr
IoDeviceObjectType
KeQuerySystemTime
ZwCreateKey
wcsncpy
wcsrchr
ExFreePool
ExAllocatePoolWithTag
_snprintf
strncmp
PsCreateSystemThread
PsGetVersion
KeDelayExecutionThread
ObReferenceObjectByHandle
KeTickCount
KeQueryTimeIncrement
_stricmp
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IoRegisterDriverReinitialization
_snwprintf
RtlCompareUnicodeString
PsLookupProcessByProcessId
wcschr
MmGetSystemRoutineAddress
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 85B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEALL Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDATA Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ