Static task
static1
General
-
Target
56b3e3fae40da56fc31561859a2cb323_JaffaCakes118
-
Size
40KB
-
MD5
56b3e3fae40da56fc31561859a2cb323
-
SHA1
b49153f7be66063fc67a15ee620466a305213df6
-
SHA256
a32d40d86ee6be86204f7faf862568cb076f48269d59f6ca615a9ab3b7a08151
-
SHA512
76a31ef0ef1fb243d4d7674e987a3c9f66bf39fd7edab037b0fcbab0f16463d322663c7659e0d38f98b14d6ecd78f05fce618116273ba18ddf29bb7d9f36a1f7
-
SSDEEP
768:PFNgeuc6bjfCat0QldsMZ8sXMFLuD42rlwlsoBFWBbYIyT0A1tE/Vl4kXrQP7VwK:PFNTUP0QlOyCJ2riGWFWBbz+0ko34kXG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 56b3e3fae40da56fc31561859a2cb323_JaffaCakes118
Files
-
56b3e3fae40da56fc31561859a2cb323_JaffaCakes118.sys windows:4 windows x86 arch:x86
8cce577c6bba86a0be768ff9b760a4ac
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
wcslen
swprintf
wcscat
wcscpy
RtlInitUnicodeString
ZwClose
ZwDeleteKey
ObfDereferenceObject
strncmp
IoGetCurrentProcess
ZwSetValueKey
_snwprintf
wcsncpy
wcschr
ZwQueryValueKey
ExFreePool
ExAllocatePoolWithTag
KeDelayExecutionThread
KeQuerySystemTime
MmIsAddressValid
PsGetVersion
_wcsicmp
_stricmp
wcsstr
_wcslwr
RtlAnsiStringToUnicodeString
ZwCreateKey
wcsrchr
ObReferenceObjectByHandle
ZwOpenKey
strncpy
PsLookupProcessByProcessId
IofCompleteRequest
MmGetSystemRoutineAddress
RtlCompareUnicodeString
_snprintf
_wcsnicmp
_except_handler3
KeTickCount
KeQueryTimeIncrement
ZwSetInformationFile
ZwCreateFile
RtlCopyUnicodeString
PsCreateSystemThread
PsSetCreateProcessNotifyRoutine
IoRegisterDriverReinitialization
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IoDeviceObjectType
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 56B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEALL Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ