Static task
static1
General
-
Target
db58ebaaccfa3cb69de275994ed345d9_JaffaCakes118
-
Size
40KB
-
MD5
db58ebaaccfa3cb69de275994ed345d9
-
SHA1
f09c84bfd376433800f165b352f5a38f62721997
-
SHA256
872288b5a0b7f4f80b3089596f0605c3e868164e5edd06b99aec1f0434bbf606
-
SHA512
3298c7555e23742aa3e154b62212e51bbedc8726610bb07f37445d80151e2d78b2f65af62b998f067c9b041de56d70dc9cec138b7602e2eb0f2ddf97512e1e9a
-
SSDEEP
768:BLF+UaDEdHQuORmkY+HrSEDXVdELo0DOtLeoKk8wxzHmmMEonmA0d1fBkcLcZSg4:ZF+UaewuORmX+LpzrELorjxz93omn1fN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource db58ebaaccfa3cb69de275994ed345d9_JaffaCakes118
Files
-
db58ebaaccfa3cb69de275994ed345d9_JaffaCakes118.sys windows:4 windows x86 arch:x86
6afca47db8834f87503613be50e01f97
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExFreePool
_snprintf
ExAllocatePoolWithTag
ZwSetValueKey
ZwClose
ZwOpenKey
RtlInitUnicodeString
swprintf
ObReferenceObjectByHandle
wcslen
ZwCreateKey
wcsncpy
wcsrchr
_snwprintf
_wcsicmp
PsSetCreateProcessNotifyRoutine
KeDelayExecutionThread
KeQuerySystemTime
ObfDereferenceObject
MmIsAddressValid
MmGetSystemRoutineAddress
RtlAnsiStringToUnicodeString
PsGetVersion
ZwDeleteKey
wcscat
wcscpy
wcschr
RtlCopyUnicodeString
IoDeviceObjectType
wcsstr
_wcslwr
strncmp
ZwSetInformationFile
ZwCreateFile
IoGetCurrentProcess
strncpy
PsLookupProcessByProcessId
_stricmp
RtlCompareUnicodeString
ZwQueryValueKey
_except_handler3
IofCompleteRequest
KeTickCount
KeQueryTimeIncrement
IoRegisterDriverReinitialization
PsCreateSystemThread
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
_wcsnicmp
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 71B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ