Static task
static1
General
-
Target
0cc954467587345d229433751b8bdd89_JaffaCakes118
-
Size
39KB
-
MD5
0cc954467587345d229433751b8bdd89
-
SHA1
ec7bc842dc266238420d5fe1947582dd4c4b288b
-
SHA256
b74b8246ed7341db8ec680849c843785cb7f284f91ec051e76e4cd71f03483e0
-
SHA512
df054e49ea5caf0842893bea13b20e20f35a242d4ce57585ee70a133495c26f0f6947f48cdb9df01cd74326cd9f80bfeb2bedfd99287dc156d9a54a30f790ae4
-
SSDEEP
768:3VvBrb1VQy8yK/DPUy5sGAqSlACW5ips8Qm4TTa7mQV8kONN:ltKrMMzAtli56sy4T1LLN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0cc954467587345d229433751b8bdd89_JaffaCakes118
Files
-
0cc954467587345d229433751b8bdd89_JaffaCakes118.sys windows:4 windows x86 arch:x86
b5417cb37eeace17a5fdc625e3fc4088
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_wcsicmp
ZwClose
RtlInitUnicodeString
_wcsnicmp
wcslen
ObfDereferenceObject
swprintf
ZwOpenKey
MmIsAddressValid
RtlCopyUnicodeString
RtlAnsiStringToUnicodeString
KeDelayExecutionThread
KeQuerySystemTime
ZwSetValueKey
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
wcsncpy
IoGetCurrentProcess
PsGetVersion
ZwQueryValueKey
ZwSetInformationFile
ZwCreateFile
wcscpy
RtlCompareUnicodeString
wcscat
_except_handler3
IofCompleteRequest
ZwDeleteKey
ObReferenceObjectByHandle
wcsrchr
_snwprintf
wcschr
ExAllocatePoolWithTag
wcsstr
_wcslwr
ExFreePool
strncmp
KeTickCount
KeQueryTimeIncrement
_stricmp
PsSetCreateProcessNotifyRoutine
MmGetSystemRoutineAddress
IoDeviceObjectType
PsCreateSystemThread
ZwCreateKey
_snprintf
IoRegisterDriverReinitialization
strncpy
PsLookupProcessByProcessId
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 69B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ