Static task
static1
General
-
Target
b8b9a3ee7f72ff07634f08e4cb81a537_JaffaCakes118
-
Size
39KB
-
MD5
b8b9a3ee7f72ff07634f08e4cb81a537
-
SHA1
93b2b9e34130e98bcb0a655d29a2d4cb73d69c28
-
SHA256
45a21061d23e960bb69e38348073e181d487f5248c5de321642b337fa03b80e4
-
SHA512
3208b944848fd0f71e80d55fff59d99e15b024abde0573a62378f2f36d441604e853bded179cbc593a8f6cc5b677b0b5bb074efb4ccc5dea8a3147cacfa89bb6
-
SSDEEP
768:9wairvnGknpKLoYmNVSxp95dZAammAH+2W0epefK9WdxT+n2kG3+aDZm8k8/gpBk:eFvGkgoZNYTdZ0mSLwefhxT+nDG3fpVt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b8b9a3ee7f72ff07634f08e4cb81a537_JaffaCakes118
Files
-
b8b9a3ee7f72ff07634f08e4cb81a537_JaffaCakes118.sys windows:4 windows x86 arch:x86
430b50e788a42a28082a3608319aa818
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwOpenKey
RtlInitUnicodeString
MmIsAddressValid
ZwSetInformationFile
ZwCreateFile
wcslen
wcscpy
swprintf
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
_wcsnicmp
ZwSetValueKey
RtlAnsiStringToUnicodeString
wcsncpy
IoGetCurrentProcess
PsGetVersion
ZwQueryValueKey
IoRegisterDriverReinitialization
strncmp
_wcsicmp
ZwCreateKey
wcsrchr
wcscat
IofCompleteRequest
_except_handler3
strncpy
_snwprintf
wcschr
ZwDeleteKey
KeDelayExecutionThread
KeQuerySystemTime
KeTickCount
KeQueryTimeIncrement
_stricmp
ObReferenceObjectByHandle
RtlCompareUnicodeString
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
wcsstr
_wcslwr
IoDeviceObjectType
PsSetCreateProcessNotifyRoutine
_snprintf
RtlCopyUnicodeString
PsLookupProcessByProcessId
MmGetSystemRoutineAddress
PsCreateSystemThread
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 66B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 5B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ