Static task
static1
General
-
Target
162aee50538ba193a144b0ae1d9cd3d3_JaffaCakes118
-
Size
37KB
-
MD5
162aee50538ba193a144b0ae1d9cd3d3
-
SHA1
f284bdcb80267967e4662f6c5e4dc3ceb4363601
-
SHA256
af39f717f2e154d8ec325bd02412709007c15bcf24c5ba47517190314e7d0cd8
-
SHA512
8b5ab20a3e91a608cc15031e9088069dbe177798d59a11a46cd2a51851e4b63d6b4e8ad0c32b9e599d5e978aa4cfa85b753ec982aa07638fb9183cbdd78f3131
-
SSDEEP
768:vuywCuQ61sq9Ai9vuPrDqvUecrfPInlVy3U8wc+Lxv7h0w3EtetMnci+d9S82U:2ywCk1drcrfK8wfLphf30AGQV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 162aee50538ba193a144b0ae1d9cd3d3_JaffaCakes118
Files
-
162aee50538ba193a144b0ae1d9cd3d3_JaffaCakes118.sys windows:4 windows x86 arch:x86
4a3e526ee30f11ad5c5697e9dc3e7453
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwDeleteKey
swprintf
IofCompleteRequest
ObReferenceObjectByHandle
RtlCopyUnicodeString
ZwSetValueKey
wcslen
RtlInitUnicodeString
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
IoRegisterDriverReinitialization
MmIsAddressValid
ZwOpenKey
wcsncpy
wcsrchr
IoDeviceObjectType
_wcsicmp
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
wcsstr
_wcslwr
KeTickCount
KeQueryTimeIncrement
_stricmp
ZwCreateKey
PsCreateSystemThread
_wcsnicmp
strncmp
IoGetCurrentProcess
strncpy
PsLookupProcessByProcessId
RtlCompareUnicodeString
ZwCreateFile
wcscat
wcscpy
ZwQueryValueKey
_except_handler3
KeQuerySystemTime
PsSetCreateProcessNotifyRoutine
ZwSetInformationFile
_snprintf
_snwprintf
MmGetSystemRoutineAddress
RtlAnsiStringToUnicodeString
wcschr
KeDelayExecutionThread
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 58B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 5B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ