Static task
static1
General
-
Target
0d963ddef3bf6fabb501881f34d8cd4e_JaffaCakes118
-
Size
19KB
-
MD5
0d963ddef3bf6fabb501881f34d8cd4e
-
SHA1
b4e037c785020362367c23172c50a92f78d194b7
-
SHA256
780b3ca8f19eb7e89098a902f42087eb70302a27c0dcf89e919a6a108c5ea36f
-
SHA512
faae9648ed0516581c030fc0e5061ff4e5c2dcecd77d9b6fa1186ce2b960f7e92ee8d53f6afbe63eb6024402055339ef74aa8e682459b7fc02a8b8acd1987ea5
-
SSDEEP
384:pUSrqO+2i/3hws/UxtaoO31JTXgqpNYF0n:buunaoO31JTXhp/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d963ddef3bf6fabb501881f34d8cd4e_JaffaCakes118
Files
-
0d963ddef3bf6fabb501881f34d8cd4e_JaffaCakes118.sys windows:4 windows x86 arch:x86
b4e877a4e42e837d7af70fee40dfb3c4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
wcslen
ZwLoadDriver
ZwClose
ZwWriteFile
ZwCreateFile
RtlInitUnicodeString
RtlWriteRegistryValue
_snwprintf
RtlQueryRegistryValues
Sections
.text Size: 608B - Virtual size: 602B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64B - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 256B - Virtual size: 248B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 128B - Virtual size: 122B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ