Static task
static1
General
-
Target
30d58d7afec48d544cf3c2d0ac6cf93d_JaffaCakes118
-
Size
40KB
-
MD5
30d58d7afec48d544cf3c2d0ac6cf93d
-
SHA1
4a6549f579e5da1c8dac8411119f8ffb581f2456
-
SHA256
a9e4001ab146dfc3b9c996e0ea95fc6689f68ee533a074a662df535283261591
-
SHA512
f232c90e2553eeee029547c766446d79409e78dae52f4626f27e43f44ed6b17b64c11b57f92e5efda95032af8dd5884f7eb766307c2494e205078631e3771481
-
SSDEEP
768:FYDxo/LPMdJGbbAFvN3DFViq5ydwUag30pby+pRATqqf8V:Fv/K8nAFVi62eg3Sy+SkV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 30d58d7afec48d544cf3c2d0ac6cf93d_JaffaCakes118
Files
-
30d58d7afec48d544cf3c2d0ac6cf93d_JaffaCakes118.sys windows:4 windows x86 arch:x86
a50bcd10531d2377a84ef5e7db4a80ac
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ObReferenceObjectByHandle
KeTickCount
KeQueryTimeIncrement
_stricmp
ZwClose
ZwDeleteKey
swprintf
PsCreateSystemThread
ZwSetValueKey
wcslen
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_except_handler3
MmIsAddressValid
MmGetSystemRoutineAddress
IoDeviceObjectType
ZwSetInformationFile
ZwCreateFile
wcscpy
RtlCompareUnicodeString
wcsstr
_wcslwr
KeQuerySystemTime
PsGetVersion
_wcsicmp
wcscat
strncpy
IoGetCurrentProcess
wcsncpy
RtlCopyUnicodeString
PsLookupProcessByProcessId
_wcsnicmp
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
strncmp
wcsrchr
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IoRegisterDriverReinitialization
ZwCreateKey
KeDelayExecutionThread
_snwprintf
IofCompleteRequest
RtlAnsiStringToUnicodeString
_snprintf
wcschr
PsSetCreateProcessNotifyRoutine
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 59B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ