Static task
static1
General
-
Target
ec0bb3c0ded2c4d93e66e7e7ec0f645e_JaffaCakes118
-
Size
17KB
-
MD5
ec0bb3c0ded2c4d93e66e7e7ec0f645e
-
SHA1
96e6197413ef82207116cbd4a1f780418f77d5a9
-
SHA256
77f463e1bb21d2e30c593943ad4a9f58571b8055fb4f8135f7d3a8f5d2c5ac2c
-
SHA512
11c0684cbf5d599da27c2161d5d69253bca6083561a32a5766871fec8c746499a3d575080a84a0f72c554ddf21660fb7919521cb5d946377b2ce3f425bf2b0a9
-
SSDEEP
192:v7iX2Si5gb8gVJtmR7nyr75CKh5fZiMj8ZLad+iJxEtI8QT3nC7iMOS2FGZSlbfP:v78ge7Yyrx8ZL7tIF3nDZfr3Sy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ec0bb3c0ded2c4d93e66e7e7ec0f645e_JaffaCakes118
Files
-
ec0bb3c0ded2c4d93e66e7e7ec0f645e_JaffaCakes118.sys windows:4 windows x86 arch:x86
a78226c9dad952cca4f9a80b16cd82a8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlZeroMemory
ZwQuerySystemInformation
strcat
IoCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
ObReferenceObjectByHandle
ProbeForRead
ProbeForWrite
PsCreateSystemThread
RtlInitUnicodeString
ZwClose
IoAllocateMdl
IoFreeMdl
MmBuildMdlForNonPagedPool
MmCreateMdl
MmMapLockedPages
MmUnmapLockedPages
RtlCompareMemory
RtlFreeUnicodeString
memcpy
strcpy
InterlockedExchange
IoGetCurrentProcess
ExFreePool
KeAttachProcess
KeDetachProcess
MmGetSystemRoutineAddress
MmIsAddressValid
ObDereferenceObject
ObReferenceObjectByPointer
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
_strupr
_wcsupr
strlen
strstr
wcscmp
wcscpy
wcsstr
MmSystemRangeStart
MmSectionObjectType
IoFileObjectType
KeDelayExecutionThread
PsTerminateSystemThread
ZwCreateKey
ZwOpenFile
ZwSetValueKey
RtlCompareUnicodeString
ZwQueryInformationFile
ZwReadFile
IoIsWdmVersionAvailable
ExAllocatePool
hal
KeGetCurrentIrql
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 32B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 480B - Virtual size: 458B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ