Static task
static1
General
-
Target
0412a77a7eaccb9ccf2a600e0c00ab5c_JaffaCakes118
-
Size
29KB
-
MD5
0412a77a7eaccb9ccf2a600e0c00ab5c
-
SHA1
fe8499badaf7a0475abff072369bc3af88578b25
-
SHA256
e2575a6c7a38077a03cc60d914c50564497b876a2799d022bf9d5c463162f91e
-
SHA512
4530370c1f7faac5c2ba01f5ae3e41e3beffc589819515c878772d020f2e1f64168873e41d4f2c5d451f1e7f35f47a7d1e8ef161e6cb7cfffaa5f85b5b5db908
-
SSDEEP
768:HDJJXAhFgDCklD8TP0yGEl3/JsdtA1CUDVJ:dFAhFgjl1EhNC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0412a77a7eaccb9ccf2a600e0c00ab5c_JaffaCakes118
Files
-
0412a77a7eaccb9ccf2a600e0c00ab5c_JaffaCakes118.sys windows:4 windows x86 arch:x86
21efce02bd4f686d5144d60090be7cc9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_snprintf
ExFreePool
ExAllocatePoolWithTag
ZwQuerySystemInformation
RtlCopyUnicodeString
RtlInitUnicodeString
swprintf
wcslen
ObfDereferenceObject
ObQueryNameString
wcscat
_stricmp
strncmp
IoGetCurrentProcess
_wcsnicmp
wcscpy
strncpy
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
RtlCompareUnicodeString
ZwUnmapViewOfSection
IofCompleteRequest
RtlAnsiStringToUnicodeString
MmIsAddressValid
_strnicmp
MmGetSystemRoutineAddress
_except_handler3
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 704B - Virtual size: 686B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ