Static task
static1
General
-
Target
3ba3ccf644748047d8bc071c3ad6d986_JaffaCakes118
-
Size
40KB
-
MD5
3ba3ccf644748047d8bc071c3ad6d986
-
SHA1
11cd1f21adfd04690d040dd6349d5a6fa0eb88ef
-
SHA256
df9dafbc97286f4fedb24378b96154d75266c157c65940bb5af7429ff3b120fb
-
SHA512
92354b2eb8ef4824373cf15dc995f3798f544444b2c5153fddc469b3d02ce7cfc8ae47f9619708562ccdf5fc7cf93d8334f452f5c36476356d16c707ce21896e
-
SSDEEP
768:PVnsrcFNNZqDa7G277Q2xcwpxjThtwB9iWiPcSmHXl:tnsrcFN/qDoG277Q2WGxJqiWmcSmH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3ba3ccf644748047d8bc071c3ad6d986_JaffaCakes118
Files
-
3ba3ccf644748047d8bc071c3ad6d986_JaffaCakes118.sys windows:4 windows x86 arch:x86
96f2a626d3d2d86e26e2ea5377371c6f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwSetValueKey
ZwClose
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_except_handler3
wcslen
ZwCreateKey
swprintf
wcsncpy
wcsrchr
_wcsicmp
KeDelayExecutionThread
KeQuerySystemTime
PsSetCreateProcessNotifyRoutine
wcsstr
_wcslwr
strncpy
PsLookupProcessByProcessId
_stricmp
ObReferenceObjectByHandle
RtlCopyUnicodeString
_wcsnicmp
MmIsAddressValid
IoGetCurrentProcess
PsGetVersion
strncmp
RtlCompareUnicodeString
MmGetSystemRoutineAddress
ZwDeleteKey
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
ZwSetInformationFile
ZwCreateFile
wcscpy
PsCreateSystemThread
RtlAnsiStringToUnicodeString
IoDeviceObjectType
IofCompleteRequest
KeTickCount
KeQueryTimeIncrement
IoRegisterDriverReinitialization
wcscat
_snwprintf
wcschr
_snprintf
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 85B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ