Static task
static1
General
-
Target
fde21c58a01bc13f58437f152b8ea539_JaffaCakes118
-
Size
27KB
-
MD5
fde21c58a01bc13f58437f152b8ea539
-
SHA1
11c9311e2d8b89b20d3deba03852c19a1c88accd
-
SHA256
38f050ece9080627a2dfdad7e823bb0bd19477c0ef5d4537efe50fe91ef00ed4
-
SHA512
cceb325edf4fad177cec6c57cd4af434748d5c6c3bcd26a67386a7dd02e76ba894d86d4650f66a8b48dc7b916e44fc1f9731b22dcfae08712bc6f2b94b3da352
-
SSDEEP
768:rkPPgJbNT6fX+R4W292nVu0qbwuWSXU3iC0t3:rwoJbNArW292o0AWNp0t
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fde21c58a01bc13f58437f152b8ea539_JaffaCakes118
Files
-
fde21c58a01bc13f58437f152b8ea539_JaffaCakes118.sys windows:4 windows x86 arch:x86
1720e63bc698dac277cd8ec19b2c59c3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
RtlInitUnicodeString
wcslen
swprintf
RtlAnsiStringToUnicodeString
MmIsAddressValid
RtlCompareUnicodeString
_except_handler3
_wcsnicmp
ExFreePool
ExAllocatePoolWithTag
wcscat
wcscpy
_stricmp
strncpy
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
_snprintf
ZwQuerySystemInformation
ZwUnmapViewOfSection
_strnicmp
IofCompleteRequest
MmGetSystemRoutineAddress
ObfDereferenceObject
ObQueryNameString
RtlCopyUnicodeString
IoGetCurrentProcess
strncmp
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 704B - Virtual size: 700B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ