Static task
static1
General
-
Target
ce8d97af320cc8d9c97750efc598673e_JaffaCakes118
-
Size
40KB
-
MD5
ce8d97af320cc8d9c97750efc598673e
-
SHA1
685bdccd4b1dccdc83e9ea91f513986bb651241c
-
SHA256
13efe3a7adfd66b8df7052dd1c7b73ee34b98be17ba6991924acc40e0ef86ee2
-
SHA512
63d8372d1fed780c0ad26d2ebd8d4f4949e4a1088efa4e9001cd6e80f982b140c558b9c2a6d307656fd976046e068afdcf0447d150400a4078bb8ad6692a7691
-
SSDEEP
768:WgrcaBJ7+/ZtYCz3PrpXdYpwv+WANiGw4UqHwjE2rgLWr9rdQn742HpE/2qT9UDK:Wvai/vYCjdEziTHpw28c2n74OpySPDK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ce8d97af320cc8d9c97750efc598673e_JaffaCakes118
Files
-
ce8d97af320cc8d9c97750efc598673e_JaffaCakes118.sys windows:4 windows x86 arch:x86
903525bf312139f6eaded6ca316c431d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwCreateFile
RtlInitUnicodeString
swprintf
_wcsnicmp
wcslen
_snwprintf
wcsncpy
wcschr
_stricmp
wcsstr
_wcslwr
ZwDeleteKey
ZwOpenKey
RtlAnsiStringToUnicodeString
wcscat
wcscpy
ZwSetValueKey
ObReferenceObjectByHandle
KeQuerySystemTime
RtlCompareUnicodeString
PsGetVersion
ZwCreateKey
wcsrchr
strncpy
IoGetCurrentProcess
MmIsAddressValid
ZwQueryValueKey
KeTickCount
KeQueryTimeIncrement
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
ZwSetInformationFile
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsLookupProcessByProcessId
KeDelayExecutionThread
_except_handler3
strncmp
_wcsicmp
RtlCopyUnicodeString
IoDeviceObjectType
MmGetSystemRoutineAddress
IofCompleteRequest
PsSetCreateProcessNotifyRoutine
IoRegisterDriverReinitialization
PsCreateSystemThread
_snprintf
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 96B - Virtual size: 70B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ