Static task
static1
General
-
Target
f123ae4c2b0efafaacf70f5ff483cbbd_JaffaCakes118
-
Size
26KB
-
MD5
f123ae4c2b0efafaacf70f5ff483cbbd
-
SHA1
a2f9d0ba1198bd86abbb0d625b8836d30b0bcc05
-
SHA256
4ffbf50128d9024ca276aa8d869486e14c93f4185e6563dac4df4f0df78f8fba
-
SHA512
66f780804c42a74e168f32a15bcb7c1c2b2a903447cc56f7cb91796a0c1dcbcbec9c62b71e14c163246add5759270e35f08667fced770975277ce3c292f5dcc6
-
SSDEEP
768:qVS7XNKRfLO2zFUtR0JybNchKSNuX3OXSvTTJTYdpJBHUXVn8Cx1sU9DfI:qVS7XMfL9pUcJyeKSIX3OXSvflYfwXdu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f123ae4c2b0efafaacf70f5ff483cbbd_JaffaCakes118
Files
-
f123ae4c2b0efafaacf70f5ff483cbbd_JaffaCakes118.sys windows:5 windows x86 arch:x86
c82ba8b369aa84ea24afd143c7e52a9d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IofCompleteRequest
IoGetCurrentProcess
strncmp
PsGetVersion
strncpy
ZwClose
ZwCreateFile
RtlInitUnicodeString
IoRegisterDriverReinitialization
ExFreePool
wcscpy
ZwEnumerateKey
wcscat
ExAllocatePoolWithTag
ZwOpenKey
KeDelayExecutionThread
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ZwQueryInformationFile
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsCreateSystemThread
_wcsnicmp
wcslen
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
KeServiceDescriptorTable
ZwSetValueKey
wcsncmp
towlower
ZwDeleteValueKey
_except_handler3
ZwQueryValueKey
_strnicmp
wcsstr
Sections
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 768B - Virtual size: 762B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ