Static task
static1
General
-
Target
e2458f91fa16dc2a65c52ca8ae28424a_JaffaCakes118
-
Size
40KB
-
MD5
e2458f91fa16dc2a65c52ca8ae28424a
-
SHA1
d2b0ad208070dd01599091a6eda69bb249e2a9d9
-
SHA256
e52f1d6a46dbcb258828317fafea5ff71195936d64fa1745ef220eae1576141a
-
SHA512
20c50df348d8b0b1186fe1128fdb6119afdcddf45f5a300b4525c8a8eeec89a4d87f05ff5e6e698d8764221cc9069ef184402a86f89fa86647f1d8dda5889823
-
SSDEEP
768:lZ6zyT3HIt6oC0GnmU5MVE/LfO5EVafgBJUu69XqJRM5eN4Hg8aKbk5A5g57571X:XwycPC0GntMVE/LfOCwgBJx61wNOm5AY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e2458f91fa16dc2a65c52ca8ae28424a_JaffaCakes118
Files
-
e2458f91fa16dc2a65c52ca8ae28424a_JaffaCakes118.sys windows:4 windows x86 arch:x86
32ca54bd5deba5c684f02aa09cddcf46
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
strncmp
ZwClose
ZwSetValueKey
ZwCreateKey
RtlInitUnicodeString
_wcsnicmp
wcslen
ObfDereferenceObject
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsSetCreateProcessNotifyRoutine
ZwDeleteKey
swprintf
_wcsicmp
RtlCopyUnicodeString
MmIsAddressValid
IoDeviceObjectType
RtlCompareUnicodeString
KeTickCount
KeQueryTimeIncrement
_stricmp
wcscat
wcscpy
ZwQueryValueKey
ZwOpenKey
_except_handler3
ObReferenceObjectByHandle
strncpy
IoGetCurrentProcess
KeDelayExecutionThread
KeQuerySystemTime
_snwprintf
ExAllocatePoolWithTag
ExFreePool
_snprintf
wcsstr
_wcslwr
MmGetSystemRoutineAddress
PsCreateSystemThread
IofCompleteRequest
wcsncpy
wcsrchr
IoRegisterDriverReinitialization
ZwCreateFile
ZwSetInformationFile
PsGetVersion
PsLookupProcessByProcessId
wcschr
RtlAnsiStringToUnicodeString
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 88B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ