Static task
static1
General
-
Target
14987defd5574cedcac7d39d502fc3e8_JaffaCakes118
-
Size
51KB
-
MD5
14987defd5574cedcac7d39d502fc3e8
-
SHA1
c6dbca0570591b0767c0982bb026d21001c9381e
-
SHA256
bb826ee0e55514f505dfd6642595a5113744d8f33109de3a189617f37ece3618
-
SHA512
dcd447bcb3f3d18bff4be4106a911786e85b952dcca6b6c959b1e65d313c033e6eda13e28549bcccf89c9e060de473efe90dce6df623d3d78ddd5c990713a3de
-
SSDEEP
768:exwste1fSkqM0sLxqUtCO8YhcaGbouuTDypfM+TMNGGsPLtJwrhu12:exm1t9lB8YyTeypfMOMiJKkw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 14987defd5574cedcac7d39d502fc3e8_JaffaCakes118
Files
-
14987defd5574cedcac7d39d502fc3e8_JaffaCakes118.sys windows:4 windows x86 arch:x86
b49dff779114679dd84911a063bc071a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
wcsstr
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
_except_handler3
_wcsnicmp
wcslen
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
_strnicmp
wcsncmp
towlower
MmGetSystemRoutineAddress
ExFreePool
wcscpy
ZwEnumerateKey
wcscat
ExAllocatePoolWithTag
KeDelayExecutionThread
PsCreateSystemThread
RtlCopyUnicodeString
strncmp
IoGetCurrentProcess
PsGetVersion
strncpy
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
IoRegisterDriverReinitialization
IofCompleteRequest
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
ZwSetValueKey
ZwDeleteValueKey
Sections
.text Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 256B - Virtual size: 240B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 992B - Virtual size: 982B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ