Static task
static1
General
-
Target
c09e9a61b2d151b5318632e93807c1a1_JaffaCakes118
-
Size
40KB
-
MD5
c09e9a61b2d151b5318632e93807c1a1
-
SHA1
5e2021930a57b8d447c0309917475401438a8833
-
SHA256
bf827e2950da072e17e85eb5f1a590ab628bfe7dc0d1d5b0e453c1a59d3f72e4
-
SHA512
d75be13e1361583388c998e571d6758ffb67b3923948625b564002f4bbb0c0f5c5cda079b504f7325ee312474b4d8f9db4f11abaa24067fcc39968144091b5f8
-
SSDEEP
768:D3j2o/A5jDdfrsblbbymuCUeqwpEjezezLozFZyYGFOJoZ8scAx8IzO4pqC:DKo/CDxYbl6tvwSzMpZynOJrsDx8IKqT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c09e9a61b2d151b5318632e93807c1a1_JaffaCakes118
Files
-
c09e9a61b2d151b5318632e93807c1a1_JaffaCakes118.sys windows:4 windows x86 arch:x86
521aaae422d4585a072972367ed87a4d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
PsCreateSystemThread
RtlInitUnicodeString
ZwSetInformationFile
ZwCreateFile
wcslen
wcscpy
swprintf
_snwprintf
wcsncpy
wcschr
MmIsAddressValid
_wcsicmp
ObfDereferenceObject
ZwSetValueKey
KeTickCount
KeQueryTimeIncrement
_stricmp
MmGetSystemRoutineAddress
ZwCreateKey
wcscat
KeQuerySystemTime
ZwOpenKey
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
wcsstr
_wcslwr
PsSetCreateProcessNotifyRoutine
RtlCompareUnicodeString
ExAllocatePoolWithTag
ObReferenceObjectByHandle
wcsrchr
IoRegisterDriverReinitialization
ZwQueryValueKey
RtlAnsiStringToUnicodeString
IofCompleteRequest
KeDelayExecutionThread
ZwDeleteKey
RtlCopyUnicodeString
_wcsnicmp
_except_handler3
strncmp
ExFreePool
PsGetVersion
strncpy
IoGetCurrentProcess
_snprintf
IoDeviceObjectType
PsLookupProcessByProcessId
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 62B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ