Static task
static1
General
-
Target
273543fc7c057dcea5235223fc8156bf_JaffaCakes118
-
Size
41KB
-
MD5
273543fc7c057dcea5235223fc8156bf
-
SHA1
0641d575f0d5f791c9f6d8549ae2b4d812d77f0f
-
SHA256
bcb42128314676814b2d42966453b6a9322ecae0ba3404a18a5eb1c6f9bbf81a
-
SHA512
9ca4f49c32a232031c54c6e24b27e3ff6acd4cb9bef8f429a797c5c0580f5650d895f93b93cea258149a734d9c86c531466192532df3781fca062087490ec375
-
SSDEEP
768:n+Zgr9aesM+am6EPWfilEw8zeySjj/r2s69lNpGb2Z7sw6Fi+DNGzeVFmX1P:n+mYdM+am6EuaSw8CySXX69lN4g7swoU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 273543fc7c057dcea5235223fc8156bf_JaffaCakes118
Files
-
273543fc7c057dcea5235223fc8156bf_JaffaCakes118.sys windows:4 windows x86 arch:x86
abc05e7e915fdee759aba7990fdb787f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwDeleteKey
swprintf
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
wcsstr
_wcslwr
ZwSetInformationFile
ZwCreateFile
wcslen
wcscpy
_wcsicmp
PsSetCreateProcessNotifyRoutine
MmIsAddressValid
_wcsnicmp
IoDeviceObjectType
ZwSetValueKey
ObReferenceObjectByHandle
ObfDereferenceObject
_stricmp
ZwCreateKey
wcsncpy
wcsrchr
PsGetVersion
strncmp
strncpy
IoGetCurrentProcess
PsLookupProcessByProcessId
wcscat
_except_handler3
ExFreePool
_snprintf
ExAllocatePoolWithTag
KeQuerySystemTime
KeDelayExecutionThread
IoRegisterDriverReinitialization
_snwprintf
IofCompleteRequest
KeTickCount
KeQueryTimeIncrement
RtlCompareUnicodeString
RtlAnsiStringToUnicodeString
MmGetSystemRoutineAddress
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlCopyUnicodeString
PsCreateSystemThread
wcschr
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 80B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEALL Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ