Static task
static1
General
-
Target
dd36031c1ea591aa497e3100b1446fae_JaffaCakes118
-
Size
40KB
-
MD5
dd36031c1ea591aa497e3100b1446fae
-
SHA1
4f51649e0389401a5837303d22d4cf25afadece4
-
SHA256
5c707c7b0b9b75447e25c954cb3c465840dfda8d8debeb4c912927c9b6d37dd2
-
SHA512
95f40765ca870b99fcf971882fc01a8b1f98e114ae63f94724c0176c3989aed77dd68bac40111a55a353c65953d38d52a948fb78331a93b33c8c91dffcf60b61
-
SSDEEP
768:1wBrHRhiuwaU4JdjFRaAfyr6U5iHJV+CCRc/kqmt0tn39QEsMslwjCr1THkl002K:GZjiudRPdnU5Y+C6q4Q3OErCr1THkl0e
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dd36031c1ea591aa497e3100b1446fae_JaffaCakes118
Files
-
dd36031c1ea591aa497e3100b1446fae_JaffaCakes118.sys windows:4 windows x86 arch:x86
9f37eb3ab7c286748975062d76b1006e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IofCompleteRequest
RtlInitUnicodeString
ZwClose
ZwSetValueKey
ZwQueryValueKey
ZwOpenKey
_except_handler3
ExFreePool
_snprintf
ExAllocatePoolWithTag
PsSetCreateProcessNotifyRoutine
wcsstr
_wcslwr
IoRegisterDriverReinitialization
wcslen
ZwCreateKey
swprintf
wcsncpy
wcsrchr
RtlAnsiStringToUnicodeString
wcscat
wcscpy
_wcsicmp
strncpy
PsLookupProcessByProcessId
_stricmp
KeTickCount
KeQueryTimeIncrement
_snwprintf
wcschr
IoGetCurrentProcess
RtlCompareUnicodeString
ObfDereferenceObject
PsGetVersion
_wcsnicmp
MmIsAddressValid
ObReferenceObjectByHandle
strncmp
PsCreateSystemThread
ZwSetInformationFile
ZwCreateFile
MmGetSystemRoutineAddress
KeQuerySystemTime
ZwDeleteKey
RtlCopyUnicodeString
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
KeDelayExecutionThread
IoDeviceObjectType
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 59B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ