Static task
static1
General
-
Target
f51351d128c5c282ae4bae0e406e9106_JaffaCakes118
-
Size
40KB
-
MD5
f51351d128c5c282ae4bae0e406e9106
-
SHA1
ca46b02858e2b72cd1cd6a4edafbb9b786fcf150
-
SHA256
03caf1879883f6416d4a86201c895eb6b08b93f8345c529181baf136b98279fe
-
SHA512
ec441fbce71f3a809ec841a16ab9eac283887568fc2317ec2f54b0f4c35b80e082f7137877f4121b792bb448cc356d11eec78f8b7d611a533583a8b958eb77fb
-
SSDEEP
768:vgAytWLprclC60gS8QGEFbmWzLyZ7Asy/0A/M5Qr5GaY/7KZ426VcPRZJ5mzAW4c:pytWLGlBa/ddMgWQ5FYDKZTd5mzPD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f51351d128c5c282ae4bae0e406e9106_JaffaCakes118
Files
-
f51351d128c5c282ae4bae0e406e9106_JaffaCakes118.sys windows:4 windows x86 arch:x86
b09c4f4faf32ac506e2dcfe3aa93dd5d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeDelayExecutionThread
KeQuerySystemTime
ZwClose
ZwSetValueKey
wcslen
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_except_handler3
strncmp
IoGetCurrentProcess
swprintf
_stricmp
wcsstr
_wcslwr
wcscat
wcscpy
_wcsicmp
MmIsAddressValid
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ObfDereferenceObject
ObReferenceObjectByHandle
wcsncpy
wcsrchr
ExFreePool
ExAllocatePoolWithTag
RtlCopyUnicodeString
PsSetCreateProcessNotifyRoutine
MmGetSystemRoutineAddress
_snwprintf
wcschr
PsGetVersion
RtlCompareUnicodeString
ZwCreateKey
RtlAnsiStringToUnicodeString
KeTickCount
KeQueryTimeIncrement
_snprintf
ZwSetInformationFile
ZwCreateFile
strncpy
IoDeviceObjectType
ZwDeleteKey
IofCompleteRequest
PsCreateSystemThread
IoRegisterDriverReinitialization
_wcsnicmp
PsLookupProcessByProcessId
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEALL Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 96B - Virtual size: 71B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ