Static task
static1
General
-
Target
d9e6287aab3d5a7e8f8df9bb55c7ff92_JaffaCakes118
-
Size
37KB
-
MD5
d9e6287aab3d5a7e8f8df9bb55c7ff92
-
SHA1
4de3744908e2fff61d44b9f11aef56493ac6584d
-
SHA256
a7c36625730b9fe3f858530e736db17351bca2809c29212ef796dfc0030bf398
-
SHA512
ba18f5bb468f214e7ba7c509e1f9ca11f236929e567b98f6cdd61ad9c255a84de33289e07d3846c66627da4af7c4f4c29bec1c98fbba83e9cd6ff22b16d75a27
-
SSDEEP
768:nwiAQlpOK+uOpfJZPXpYqt9fnvE1jv//6a6irarHvLO:nBvpOKsfvPXyqt9mkri
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d9e6287aab3d5a7e8f8df9bb55c7ff92_JaffaCakes118
Files
-
d9e6287aab3d5a7e8f8df9bb55c7ff92_JaffaCakes118.sys windows:4 windows x86 arch:x86
2fc770794e4cd3fcdc6e09224b94a2b9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwSetValueKey
wcslen
MmIsAddressValid
ZwClose
swprintf
ZwOpenKey
RtlInitUnicodeString
ZwQueryValueKey
_except_handler3
ZwCreateKey
wcsncpy
wcsrchr
strncpy
IoGetCurrentProcess
PsLookupProcessByProcessId
_stricmp
ExFreePool
_snprintf
ExAllocatePoolWithTag
RtlCompareUnicodeString
_wcsnicmp
ZwCreateFile
ObfDereferenceObject
RtlCopyUnicodeString
KeTickCount
KeQueryTimeIncrement
IoDeviceObjectType
ZwDeleteKey
ZwSetInformationFile
wcscpy
PsSetCreateProcessNotifyRoutine
strncmp
PsCreateSystemThread
IofCompleteRequest
_snwprintf
wcschr
ObReferenceObjectByHandle
KeDelayExecutionThread
KeQuerySystemTime
wcscat
wcsstr
_wcslwr
_wcsicmp
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
MmGetSystemRoutineAddress
IoRegisterDriverReinitialization
RtlAnsiStringToUnicodeString
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 67B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 5B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ