Static task
static1
General
-
Target
074bb22bd08802b61c06a1a277462a08_JaffaCakes118
-
Size
37KB
-
MD5
074bb22bd08802b61c06a1a277462a08
-
SHA1
1b530983867b2102c8ee411d75b8182c72e61010
-
SHA256
4abd527dbd5057e039e34ef322e58ecd75284414657283f5202e828fa6eb68aa
-
SHA512
04a883336fa2f4f355f133e29ae54e819564da47d117bb4126a747ada7be4bbc10d66ac6eb22b65fdc58f356723a70afd4ba75f695149f7ac71d142894917abf
-
SSDEEP
768:v1INoDAnjzCKBdwxMfMiEIumY8r4kbQw5C1oeDQblWwwLyDznX:qNoDvKBQMCIfpckbDQoe8bcJ8j
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 074bb22bd08802b61c06a1a277462a08_JaffaCakes118
Files
-
074bb22bd08802b61c06a1a277462a08_JaffaCakes118.sys windows:4 windows x86 arch:x86
0f4cfad7f51a5b5178b5ed17f207a568
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_wcsicmp
KeDelayExecutionThread
KeQuerySystemTime
swprintf
wcslen
wcscat
wcscpy
ZwClose
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_except_handler3
wcsstr
_wcslwr
PsCreateSystemThread
RtlCompareUnicodeString
PsSetCreateProcessNotifyRoutine
IoRegisterDriverReinitialization
ZwCreateKey
wcsncpy
wcsrchr
ZwSetValueKey
ObReferenceObjectByHandle
ZwCreateFile
_snwprintf
ExAllocatePoolWithTag
_stricmp
strncpy
IoGetCurrentProcess
ExFreePool
_snprintf
ObfDereferenceObject
ZwSetInformationFile
_wcsnicmp
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ZwDeleteKey
RtlCopyUnicodeString
strncmp
MmIsAddressValid
IoDeviceObjectType
MmGetSystemRoutineAddress
wcschr
IofCompleteRequest
PsLookupProcessByProcessId
KeTickCount
KeQueryTimeIncrement
RtlAnsiStringToUnicodeString
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 64B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 5B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ