Static task
static1
General
-
Target
df490007d0eb3b108b8fd2edeed4a926_JaffaCakes118
-
Size
40KB
-
MD5
df490007d0eb3b108b8fd2edeed4a926
-
SHA1
76326aa1e3875bf24650417b346eebf8e57bd08d
-
SHA256
1adaafc91cda25ea5c90f4e58a9f6e6fddc079e7e99d13af90a07ffffc527bc3
-
SHA512
a9f619938dc8becc010b52df0092f94d2675ea0017470fb6dd00bddea200500f5db392556ab3704f5f8502f6e8b2ab4f7f220036df79bc8e9c01077691ebcd76
-
SSDEEP
768:5u7+XlLCrm0Xb+x91onFwsMGVSbX18fbjn7g75BgzrHL6VGXgs:5u7+XlId+xZsLVyX1Ibjn7g75+rE6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df490007d0eb3b108b8fd2edeed4a926_JaffaCakes118
Files
-
df490007d0eb3b108b8fd2edeed4a926_JaffaCakes118.sys windows:4 windows x86 arch:x86
f11fa8a28eae68dbe0d641ec449729a8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IofCompleteRequest
ZwClose
ZwDeleteKey
swprintf
ZwSetValueKey
wcslen
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_except_handler3
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
ObReferenceObjectByHandle
RtlAnsiStringToUnicodeString
MmIsAddressValid
_snprintf
wcsncpy
IoGetCurrentProcess
PsGetVersion
ZwCreateFile
wcscat
wcscpy
ZwCreateKey
wcsrchr
RtlCopyUnicodeString
_wcsicmp
strncpy
PsLookupProcessByProcessId
_stricmp
IoDeviceObjectType
_snwprintf
wcschr
strncmp
_wcsnicmp
KeTickCount
KeQueryTimeIncrement
wcsstr
_wcslwr
MmGetSystemRoutineAddress
PsSetCreateProcessNotifyRoutine
ZwSetInformationFile
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsCreateSystemThread
RtlCompareUnicodeString
KeDelayExecutionThread
KeQuerySystemTime
IoRegisterDriverReinitialization
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 72B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ