Static task
static1
General
-
Target
e031be25a7bb4e549813824516e4c87c_JaffaCakes118
-
Size
40KB
-
MD5
e031be25a7bb4e549813824516e4c87c
-
SHA1
ac940e82f8764e76d444b01d4450337e673213f3
-
SHA256
c87f71bc26e3444c2c2a89db3817d040d9d9d844b8817e1e6f25bff5e148709b
-
SHA512
72caf8feab278911120bb93205a3f1b676e7e0b13b1aea43638fa375b6114cf020bd047b4234e528b3ae25609d1e412549077a777eb8941a0d8e8b0e18cccf6d
-
SSDEEP
768:nMi8ANT0jTgJK5jg/yEjvmxwkd6GaXeueeW8t6TDlNl9LmRnmi0gKyzQpwwRgexF:nPdZ0nIKBe7vmxwkd6Gdbh8AgKxpw4Nc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e031be25a7bb4e549813824516e4c87c_JaffaCakes118
Files
-
e031be25a7bb4e549813824516e4c87c_JaffaCakes118.sys windows:4 windows x86 arch:x86
1d2f8fd49fbbec162f826f9200758805
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwSetValueKey
wcslen
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_except_handler3
ObfDereferenceObject
MmIsAddressValid
ObReferenceObjectByHandle
wcsncpy
wcsrchr
RtlCompareUnicodeString
ExFreePool
ExAllocatePoolWithTag
ZwDeleteKey
_snwprintf
wcschr
wcsstr
_wcslwr
strncpy
PsLookupProcessByProcessId
_stricmp
_wcsicmp
_snprintf
ZwSetInformationFile
ZwCreateFile
wcscpy
swprintf
RtlAnsiStringToUnicodeString
IoGetCurrentProcess
PsGetVersion
IofCompleteRequest
MmGetSystemRoutineAddress
wcscat
IoDeviceObjectType
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlCopyUnicodeString
KeDelayExecutionThread
KeQuerySystemTime
IoRegisterDriverReinitialization
_wcsnicmp
PsCreateSystemThread
strncmp
PsSetCreateProcessNotifyRoutine
ZwCreateKey
KeTickCount
KeQueryTimeIncrement
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 60B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEALL Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ