Static task
static1
General
-
Target
54bb537dda4dff67cdf8a07e1b32eb91_JaffaCakes118
-
Size
40KB
-
MD5
54bb537dda4dff67cdf8a07e1b32eb91
-
SHA1
8e5e5623127db37bf075e9776a85d1b44c52da4b
-
SHA256
73302efced416162fa119fd979edeae1716e8da52ad08b0d70e634198d11f478
-
SHA512
e80e9939569c3f9cef16333158b645e3319ab8766e944b1a9d667a5e954ef5325dea4c5f7bfd282bcf4f6cb45a5ff8ffacdbfd0c65de2aa426ad92310f23dbb1
-
SSDEEP
768:5lb+xwkinHdOunDucCcn5TSz2G+6A1eBAJvGaZyG2ggU6WnNpDhqlr3:e6nYunD9RAR+6A1eeZGacG2gb/7Ilr3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 54bb537dda4dff67cdf8a07e1b32eb91_JaffaCakes118
Files
-
54bb537dda4dff67cdf8a07e1b32eb91_JaffaCakes118.sys windows:4 windows x86 arch:x86
7a8f16b6b17c34b22d7116176a09483a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitUnicodeString
wcslen
ZwCreateKey
swprintf
wcsncpy
wcsrchr
_snwprintf
wcschr
MmIsAddressValid
ZwClose
ZwOpenKey
RtlCopyUnicodeString
ZwQueryValueKey
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
ZwDeleteKey
RtlCompareUnicodeString
ZwSetValueKey
_wcsnicmp
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IoRegisterDriverReinitialization
_except_handler3
strncmp
IofCompleteRequest
PsGetVersion
PsCreateSystemThread
strncpy
IoGetCurrentProcess
ObReferenceObjectByHandle
PsLookupProcessByProcessId
_stricmp
wcscat
wcscpy
IoDeviceObjectType
wcsstr
_wcslwr
PsSetCreateProcessNotifyRoutine
KeTickCount
KeQueryTimeIncrement
_snprintf
_wcsicmp
MmGetSystemRoutineAddress
ZwCreateFile
KeDelayExecutionThread
KeQuerySystemTime
RtlAnsiStringToUnicodeString
ZwSetInformationFile
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 96B - Virtual size: 70B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ