Static task
static1
General
-
Target
bac13f7c175df9a47ab2649af4832bb2_JaffaCakes118
-
Size
39KB
-
MD5
bac13f7c175df9a47ab2649af4832bb2
-
SHA1
6930de2c76ce462c2990789f4ecaf364674b5622
-
SHA256
37235f671815ca560081c31e44bd29799383cd16dbb1eae92ee31a356fcf9ba4
-
SHA512
224c42fc86e6c060b013e8d4bd49ba6e99389a6bea944d62f884d0fdb7cb7d12d925a6bdd2a70e72abe5bca22c74df446869a946f58c5d99cdbd5ce3228fcc6b
-
SSDEEP
768:fHn6SJubjDhI0ZfZhfgLHrRUvTFZCyJQBtO2iwH0DmGCcBemRa:NJubXXrmHCv5tJstcwH0KGzBemY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bac13f7c175df9a47ab2649af4832bb2_JaffaCakes118
Files
-
bac13f7c175df9a47ab2649af4832bb2_JaffaCakes118.sys windows:4 windows x86 arch:x86
393e5d7c9736d7851bc33b33178cb9ef
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
PsSetCreateProcessNotifyRoutine
_stricmp
swprintf
wcsstr
_wcslwr
RtlCopyUnicodeString
ZwClose
PsGetVersion
ObfDereferenceObject
MmIsAddressValid
ObReferenceObjectByHandle
ZwOpenKey
RtlInitUnicodeString
wcsncpy
wcsrchr
_wcsicmp
ZwDeleteKey
wcslen
wcscat
wcscpy
PsCreateSystemThread
strncmp
IoGetCurrentProcess
ZwCreateKey
RtlCompareUnicodeString
KeQuerySystemTime
ZwCreateFile
IofCompleteRequest
ExFreePool
_snprintf
ExAllocatePoolWithTag
strncpy
_snwprintf
wcschr
_wcsnicmp
RtlAnsiStringToUnicodeString
ZwSetValueKey
ZwQueryValueKey
_except_handler3
KeTickCount
KeQueryTimeIncrement
IoRegisterDriverReinitialization
IoDeviceObjectType
MmGetSystemRoutineAddress
PsLookupProcessByProcessId
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ZwSetInformationFile
KeDelayExecutionThread
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 64B - Virtual size: 46B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ