Static task
static1
General
-
Target
d55e65cc271a7071375c0e69f4fb9559_JaffaCakes118
-
Size
39KB
-
MD5
d55e65cc271a7071375c0e69f4fb9559
-
SHA1
e1e9c439f6232faf0933293e58a3994391e0c0fa
-
SHA256
18dde5a4feecd171813aa950eb39b36f23d970aa2deac9b5d3774e6c50755f3d
-
SHA512
d6c2a056387066ff986f78e5de400b0893d08bd10b81101ace42789c7fea901a0d4180ab1747766c04e14e037d03109f5cb24fc2b00e2dcbd90a83236972e719
-
SSDEEP
768:A9H0TTI3qIsHMU64g6c0IV1gNOybBNAIbe87Fl2/s++0IYCw4ytItNF2+V33Q:Al0TTIPkO/Xz2GIbeD+0Inw4IyNFh3g
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d55e65cc271a7071375c0e69f4fb9559_JaffaCakes118
Files
-
d55e65cc271a7071375c0e69f4fb9559_JaffaCakes118.sys windows:4 windows x86 arch:x86
01cae73fa771293c5a4e4312be780177
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwDeleteKey
ZwOpenKey
RtlInitUnicodeString
_wcsnicmp
wcslen
ObfDereferenceObject
ZwSetValueKey
_snwprintf
ExAllocatePoolWithTag
MmIsAddressValid
ObReferenceObjectByHandle
wcsncpy
wcsrchr
ExFreePool
_snprintf
RtlCompareUnicodeString
ZwQueryValueKey
swprintf
wcscat
wcscpy
RtlAnsiStringToUnicodeString
_except_handler3
wcschr
IoRegisterDriverReinitialization
MmGetSystemRoutineAddress
_wcsicmp
KeTickCount
KeQueryTimeIncrement
_stricmp
PsCreateSystemThread
wcsstr
_wcslwr
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IofCompleteRequest
KeQuerySystemTime
ZwCreateKey
PsSetCreateProcessNotifyRoutine
ZwCreateFile
strncpy
IoGetCurrentProcess
IoDeviceObjectType
strncmp
KeDelayExecutionThread
PsGetVersion
RtlCopyUnicodeString
PsLookupProcessByProcessId
ZwSetInformationFile
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 73B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ