Static task
static1
General
-
Target
02f6e4d81f86785926abe0ea0369ea3d_JaffaCakes118
-
Size
39KB
-
MD5
02f6e4d81f86785926abe0ea0369ea3d
-
SHA1
6b9749c0ac16133d255c7ae6324d3ff5d5c45081
-
SHA256
ba098a5589b453fc0582dfb355286b06517c821158d90d50d93715ee5df54e38
-
SHA512
3c24a0cfc08d542d92058f29ce0e9c23e1843a569d99dcd894492f9f6a49f7e589ebaddd65dd6ff7db499ee1c392d5fed012ce4362b479bed31899caa13dbd4e
-
SSDEEP
768:vciSvjSFFPscX6nbiy4C7uYqLYOY1A6KdnpJ+E+m4lyXGsUjf3sgHKJPGD:vmjSFy1x4hYC6SEE+m4YXGsC8gHWG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 02f6e4d81f86785926abe0ea0369ea3d_JaffaCakes118
Files
-
02f6e4d81f86785926abe0ea0369ea3d_JaffaCakes118.sys windows:4 windows x86 arch:x86
9a33628ba41a50109df09230907db48a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ObfDereferenceObject
ZwClose
RtlInitUnicodeString
strncmp
IoGetCurrentProcess
PsSetCreateProcessNotifyRoutine
ZwOpenKey
swprintf
ZwQueryValueKey
ZwSetValueKey
_except_handler3
ExFreePool
_snprintf
ExAllocatePoolWithTag
MmIsAddressValid
_stricmp
wcsstr
_wcslwr
KeDelayExecutionThread
KeQuerySystemTime
wcslen
_wcsicmp
wcscat
wcscpy
_snwprintf
IofCompleteRequest
ObReferenceObjectByHandle
wcsncpy
wcsrchr
RtlAnsiStringToUnicodeString
ZwSetInformationFile
ZwCreateFile
PsCreateSystemThread
_wcsnicmp
RtlCompareUnicodeString
KeTickCount
KeQueryTimeIncrement
ZwCreateKey
IoRegisterDriverReinitialization
ZwDeleteKey
wcschr
PsGetVersion
IoDeviceObjectType
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
strncpy
PsLookupProcessByProcessId
MmGetSystemRoutineAddress
RtlCopyUnicodeString
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 56B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 5B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ