Static task
static1
General
-
Target
f563150a81136d637fa875a734e85125_JaffaCakes118
-
Size
40KB
-
MD5
f563150a81136d637fa875a734e85125
-
SHA1
7b4f5e7a35951b5145777ed29aac3bab4ad08a5d
-
SHA256
d0187f7f6440336658cba65df91a1ba259587d804301cc69c3a56d7b3fc6bbd8
-
SHA512
f0551563555541e036f96e3804cc52fecfc28282354c582c788582e6407b7b69ac050364d0269bc85039fee9e4c3d072580f8f7d242f53d8ffa6c60ba5e9d166
-
SSDEEP
768:2GGbyKjqK7aedvAtfw+I0pLVw+Oum+FE0rxuHQaPa7uPzG4Bh5+uvVY9oERnAVhl:1I+edv+fwoVw+IC5xiPa6rP+uvVVERAw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f563150a81136d637fa875a734e85125_JaffaCakes118
Files
-
f563150a81136d637fa875a734e85125_JaffaCakes118.sys windows:4 windows x86 arch:x86
32f69e4f563295fad2374022d0d68115
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwQueryValueKey
RtlInitUnicodeString
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
ZwDeleteKey
swprintf
ZwSetValueKey
ObReferenceObjectByHandle
MmGetSystemRoutineAddress
KeTickCount
KeQueryTimeIncrement
_stricmp
MmIsAddressValid
ZwOpenKey
_wcsicmp
strncmp
_wcsnicmp
wcslen
KeQuerySystemTime
_snwprintf
wcscat
wcscpy
_except_handler3
IoRegisterDriverReinitialization
wcsncpy
wcsrchr
IofCompleteRequest
RtlCopyUnicodeString
KeDelayExecutionThread
RtlAnsiStringToUnicodeString
ZwCreateKey
IoGetCurrentProcess
PsGetVersion
RtlCompareUnicodeString
PsCreateSystemThread
PsSetCreateProcessNotifyRoutine
wcsstr
_wcslwr
ZwCreateFile
ZwSetInformationFile
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
wcschr
strncpy
PsLookupProcessByProcessId
IoDeviceObjectType
_snprintf
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 45B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ