Static task
static1
General
-
Target
0322c93c93fec721fab1361d340a63c5_JaffaCakes118
-
Size
53KB
-
MD5
0322c93c93fec721fab1361d340a63c5
-
SHA1
de267050cb5de5ed9211a66fcfdcb5b75680f330
-
SHA256
716f187da750787c77bdb8475972ee778dede9c22dcf75f1addf70502b2dee1f
-
SHA512
2ef64f7ee370d4ed2ca3a261cca465a046f6e0351f6a882c45bd74370227789060b5897d125dd9882bce074868658c7c4cfaef2342ead3856ed2fe91a1739049
-
SSDEEP
768:v8Ps+Z0RapkY4Zz1Xm3GGvH21FvONcWq6vPH/cOZ2SrDKM54T+lsFQCOLnQor5+X:v8Zs5nSR1v/jlUuWkh38R1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0322c93c93fec721fab1361d340a63c5_JaffaCakes118
Files
-
0322c93c93fec721fab1361d340a63c5_JaffaCakes118.sys windows:4 windows x86 arch:x86
bd133727ab5fc0898b0da20cc7e1c7d9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwCreateFile
RtlInitUnicodeString
IoRegisterDriverReinitialization
_wcsnicmp
wcslen
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
KeDelayExecutionThread
PsCreateSystemThread
ZwSetValueKey
ZwQueryValueKey
ZwOpenKey
wcsstr
_except_handler3
IofCompleteRequest
IoGetCurrentProcess
strncmp
PsGetVersion
strncpy
ExFreePool
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ExAllocatePoolWithTag
ZwQueryInformationFile
wcsncmp
towlower
MmGetSystemRoutineAddress
wcscat
wcscpy
RtlCopyUnicodeString
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
ZwDeleteValueKey
ZwEnumerateKey
_strnicmp
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 71B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 992B - Virtual size: 982B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ