Static task
static1
General
-
Target
2ec10e7354fac4a885e0c93770f74990_JaffaCakes118
-
Size
40KB
-
MD5
2ec10e7354fac4a885e0c93770f74990
-
SHA1
9597e37c8c7d79eb25b1e143302b24c45c3b5788
-
SHA256
aa9436b687875b4aa79fd277874c0d94f122bd687625a1c2fa56fe647c08621a
-
SHA512
0b9407d72c7f5c41fcb9658911e02b893792670da805487155456f3cada379f1dec75494290b962bdd965ce6b1bd388a181b921549ed86b7201c02f938efb368
-
SSDEEP
768:dwlZUVWW1UfWENmnRBpou5ajQpDnv5J58FoIxvqQnc3Wj3DdC4UalZpHaeCwT6I8:dwXUVrmfodvhn98THnpflZ/BT6XMLig
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2ec10e7354fac4a885e0c93770f74990_JaffaCakes118
Files
-
2ec10e7354fac4a885e0c93770f74990_JaffaCakes118.sys windows:4 windows x86 arch:x86
180e0676cc4bc1387bd8830eaff64e42
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_stricmp
swprintf
wcsstr
_wcslwr
strncpy
IoGetCurrentProcess
_wcsicmp
RtlInitUnicodeString
ZwClose
ObfDereferenceObject
MmIsAddressValid
ObReferenceObjectByHandle
ZwOpenKey
wcsncpy
wcsrchr
_snwprintf
ExAllocatePoolWithTag
ZwSetValueKey
IoDeviceObjectType
KeDelayExecutionThread
KeQuerySystemTime
_wcsnicmp
wcslen
PsGetVersion
ZwQueryValueKey
ExFreePool
wcschr
ZwCreateFile
RtlCopyUnicodeString
IofCompleteRequest
PsCreateSystemThread
ZwCreateKey
IoRegisterDriverReinitialization
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
wcscat
wcscpy
_except_handler3
ZwSetInformationFile
_snprintf
KeTickCount
KeQueryTimeIncrement
RtlCompareUnicodeString
strncmp
ZwDeleteKey
MmGetSystemRoutineAddress
PsSetCreateProcessNotifyRoutine
PsLookupProcessByProcessId
RtlAnsiStringToUnicodeString
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 53B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEALL Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ