Static task
static1
General
-
Target
01c1a7c1b9e47e783325d42c4aac1714_JaffaCakes118
-
Size
40KB
-
MD5
01c1a7c1b9e47e783325d42c4aac1714
-
SHA1
ee5dc7e0c5917437d140655b6541544b0f7d5ec7
-
SHA256
b4ccfa65e58d3fe7b5daf13972a57501e64ac6275662b439f0327cc0ee612a8f
-
SHA512
2556f32e1908f46b1309a167b349b5cfc9547caba990ad34045697b0dac3164e7bdfd22e223605805814bfa8cf9d4ff77f46421879792636b5a9a98d996d1a56
-
SSDEEP
768:cpLcU1jFEVLhkhNUO1kHvTV9xbzG0AUYzMAPnsLWvqPw+kic6y1:UbaVLuN/1kHvx9x3GYQMAPnEkqI+kiP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 01c1a7c1b9e47e783325d42c4aac1714_JaffaCakes118
Files
-
01c1a7c1b9e47e783325d42c4aac1714_JaffaCakes118.sys windows:4 windows x86 arch:x86
1ae375b30ccbfc496151001975ad505f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_stricmp
swprintf
wcsstr
_wcslwr
_snwprintf
wcsncpy
wcslen
wcschr
ZwClose
ZwOpenKey
MmGetSystemRoutineAddress
RtlInitUnicodeString
IofCompleteRequest
ZwSetValueKey
ObReferenceObjectByHandle
_wcsicmp
wcsrchr
MmIsAddressValid
IoGetCurrentProcess
PsGetVersion
ZwQueryValueKey
ObfDereferenceObject
strncmp
_except_handler3
KeTickCount
KeQueryTimeIncrement
wcscat
wcscpy
_wcsnicmp
IoDeviceObjectType
KeDelayExecutionThread
KeQuerySystemTime
ZwDeleteKey
ZwCreateKey
RtlCopyUnicodeString
RtlCompareUnicodeString
ZwSetInformationFile
ZwCreateFile
PsCreateSystemThread
PsSetCreateProcessNotifyRoutine
ExFreePool
_snprintf
ExAllocatePoolWithTag
IoRegisterDriverReinitialization
strncpy
RtlAnsiStringToUnicodeString
PsLookupProcessByProcessId
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 96B - Virtual size: 91B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ