Static task
static1
General
-
Target
dfa2961d9cba346c41b9890450cdb842_JaffaCakes118
-
Size
40KB
-
MD5
dfa2961d9cba346c41b9890450cdb842
-
SHA1
966de72f6f5676eac0ed39fe4828ebcceb3b53ae
-
SHA256
91cdf2cc609ff6f3a2f0c5ace83c15ac8002a0e54c1643e58db145fc97f569f8
-
SHA512
60a1736eb7a7f1834e3be78ef90aa347894611f89455f35dd6a28a7feadb96d9fd08f629e7d780d71bb80d214758df8936ac8f89791805c3f340a0e4cea4bb60
-
SSDEEP
768:OK0n+lGHaHp2TKPFH5ko2wP6m3GXCxOHs7NjnKLo5/F53WEhUgajKM+Rih1Vc:OKra8FH51h6XH0NjnKLo5/HLajKMNVc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dfa2961d9cba346c41b9890450cdb842_JaffaCakes118
Files
-
dfa2961d9cba346c41b9890450cdb842_JaffaCakes118.sys windows:4 windows x86 arch:x86
39437353838737c15f4d965c89768b44
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitUnicodeString
ExFreePool
ExAllocatePoolWithTag
ZwClose
ObfDereferenceObject
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ZwOpenKey
strncmp
wcsstr
_wcslwr
strncpy
PsLookupProcessByProcessId
_stricmp
ZwSetValueKey
wcslen
ZwQueryValueKey
_except_handler3
swprintf
ZwCreateFile
_snwprintf
_snprintf
_wcsnicmp
ZwCreateKey
wcsncpy
wcsrchr
IoGetCurrentProcess
IoRegisterDriverReinitialization
ZwSetInformationFile
wcscpy
MmIsAddressValid
_wcsicmp
ObReferenceObjectByHandle
RtlCompareUnicodeString
KeQuerySystemTime
MmGetSystemRoutineAddress
PsCreateSystemThread
wcscat
PsSetCreateProcessNotifyRoutine
RtlCopyUnicodeString
KeDelayExecutionThread
wcschr
IoDeviceObjectType
PsGetVersion
KeTickCount
KeQueryTimeIncrement
IofCompleteRequest
RtlAnsiStringToUnicodeString
ZwDeleteKey
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 61B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ