Static task
static1
General
-
Target
f56dcbf2db0fd71f6c951fd7b024f62d_JaffaCakes118
-
Size
40KB
-
MD5
f56dcbf2db0fd71f6c951fd7b024f62d
-
SHA1
e06f108128112a1cff6fd96a0db6f38ab26cb6ed
-
SHA256
cd78e463db27c53a50f680f05062986dd7462cf8cdb09e9b770802b2740cd068
-
SHA512
adfb8fba812453d8f42365cadbec1d16d2f4a51a6ae270cf30a75c34a65f8eb4d8152b6817b5e1108352afc4ac918932cf5d4ef38b200e84b60881ee57211011
-
SSDEEP
768:5aN1SCt4rR9NM8GHYCtO2PeNVFI0oGtBiUXKHIxF4i0F3qpyzZB:41Se4rR9NMTHYYAIVkBiLG4i0Zqszf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f56dcbf2db0fd71f6c951fd7b024f62d_JaffaCakes118
Files
-
f56dcbf2db0fd71f6c951fd7b024f62d_JaffaCakes118.sys windows:4 windows x86 arch:x86
1d162d07b7ebdcf623f88f6a9d80bafb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_snwprintf
ExAllocatePoolWithTag
RtlInitUnicodeString
KeTickCount
KeQueryTimeIncrement
_stricmp
KeQuerySystemTime
_wcsicmp
wcsncpy
wcslen
wcsrchr
wcschr
swprintf
wcsstr
_wcslwr
PsSetCreateProcessNotifyRoutine
ObfDereferenceObject
ZwClose
MmIsAddressValid
ObReferenceObjectByHandle
ZwOpenKey
ZwDeleteKey
ZwSetInformationFile
ZwCreateFile
wcscpy
ZwSetValueKey
IofCompleteRequest
ZwQueryValueKey
ZwCreateKey
ExFreePool
_snprintf
IoRegisterDriverReinitialization
strncmp
RtlCopyUnicodeString
RtlAnsiStringToUnicodeString
_wcsnicmp
wcscat
PsCreateSystemThread
RtlCompareUnicodeString
_except_handler3
KeDelayExecutionThread
MmGetSystemRoutineAddress
strncpy
IoGetCurrentProcess
IoDeviceObjectType
PsLookupProcessByProcessId
PsGetVersion
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 83B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ