Static task
static1
General
-
Target
0fe6bd8c1f8c93f29af578f3095e8e03_JaffaCakes118
-
Size
40KB
-
MD5
0fe6bd8c1f8c93f29af578f3095e8e03
-
SHA1
6b325ff615694c5cbcf62492ead18ba06f5f0a63
-
SHA256
760e27f2bff3f43fe92e08c710a6d451d3fd840d79fe54b0a03ea4e54b561622
-
SHA512
dee9ee36723977acf3207217e09f136b3c9a37100293e291d7baae40e386abf3a453c735f64313495e94cc24be1e60ed66307b80c50dcbc338e587f2492ed836
-
SSDEEP
768:n8Ft/j72/Xs0U5rVoV1CNeTHvo5M9MqCq2tKuMspQdbgx84tttk:II/XxUN21ieTHIIFAUsKJge4tw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0fe6bd8c1f8c93f29af578f3095e8e03_JaffaCakes118
Files
-
0fe6bd8c1f8c93f29af578f3095e8e03_JaffaCakes118.sys windows:4 windows x86 arch:x86
08ddc3e7a157c775c1f99556ee5370a9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwSetValueKey
wcslen
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_except_handler3
ZwDeleteKey
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
strncpy
IoGetCurrentProcess
ObReferenceObjectByHandle
ZwCreateKey
MmIsAddressValid
strncmp
swprintf
_snwprintf
_wcsnicmp
ZwSetInformationFile
ZwCreateFile
wcscpy
RtlCompareUnicodeString
IofCompleteRequest
IoDeviceObjectType
RtlCopyUnicodeString
PsLookupProcessByProcessId
_stricmp
KeQuerySystemTime
wcsncpy
wcsrchr
PsGetVersion
wcsstr
_wcslwr
PsSetCreateProcessNotifyRoutine
KeTickCount
KeQueryTimeIncrement
KeDelayExecutionThread
PsCreateSystemThread
_snprintf
RtlAnsiStringToUnicodeString
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
MmGetSystemRoutineAddress
_wcsicmp
wcscat
wcschr
IoRegisterDriverReinitialization
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 64B - Virtual size: 48B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ