Static task
static1
General
-
Target
3dc15a33b71f993636ddb95c6153f8e2_JaffaCakes118
-
Size
40KB
-
MD5
3dc15a33b71f993636ddb95c6153f8e2
-
SHA1
6297524b5ddbeb1840d9284dfc576b598ce5e519
-
SHA256
bb627273800d61efe469181e74ad7adafebcab54ea1dea546a86b344991cd8e3
-
SHA512
1e4cb1b6e6a5876c589f427f1a74ab286e4c3319d0d7011881fc7eac30e9becf95f2088050cfd1f8dce0fa4db0d872508e07b9f4a148202a9149745d8ffd6b69
-
SSDEEP
768:P2HjtJfgGFWWSDV/kAAVI6rTxzv1wWA0wk3UgEK1PLD4y4qyLC2P4wBYLvUOys:0jtJYCWW0NkAAVlpvSW7xUwTD4y4qyLt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3dc15a33b71f993636ddb95c6153f8e2_JaffaCakes118
Files
-
3dc15a33b71f993636ddb95c6153f8e2_JaffaCakes118.sys windows:4 windows x86 arch:x86
c37a97db32e4990f20c2a4649125b5a6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlCopyUnicodeString
ZwClose
ZwOpenKey
RtlInitUnicodeString
ZwSetValueKey
ZwCreateKey
ObfDereferenceObject
MmIsAddressValid
ObReferenceObjectByHandle
wcsncpy
wcsrchr
swprintf
wcslen
wcscat
wcscpy
_wcsicmp
ZwQueryValueKey
_except_handler3
IoGetCurrentProcess
PsGetVersion
IoRegisterDriverReinitialization
RtlAnsiStringToUnicodeString
_snwprintf
ExAllocatePoolWithTag
strncpy
PsLookupProcessByProcessId
_stricmp
MmGetSystemRoutineAddress
KeQuerySystemTime
IoDeviceObjectType
ZwDeleteKey
strncmp
ZwCreateFile
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsCreateSystemThread
ExFreePool
_snprintf
KeDelayExecutionThread
KeTickCount
KeQueryTimeIncrement
RtlCompareUnicodeString
_wcsnicmp
IofCompleteRequest
wcsstr
_wcslwr
PsSetCreateProcessNotifyRoutine
ZwSetInformationFile
wcschr
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 67B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 5B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ