Static task
static1
General
-
Target
1649d51e7e0c8c1a923a46ef92bd7e33_JaffaCakes118
-
Size
28KB
-
MD5
1649d51e7e0c8c1a923a46ef92bd7e33
-
SHA1
c28323fb46827b148fd48ca6e5b6fc1900526f21
-
SHA256
82694c4f75d6c591e554fcf6845081992ab16cecc55ced213640e7509e60fa10
-
SHA512
c16fdc8966a8eb457c45e8a654242879fc723b8e73c8076b65885639452a7f80ecc42fc938721023c211341ecd1a1d5d024023e5f543405218d9750b27cf1a76
-
SSDEEP
768:hke/cvRbs5HzO5OH+fmyMFKGqzFo2onJERd1ugzY:d/4CHzO5Oe6KDFo2oJEXQgz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1649d51e7e0c8c1a923a46ef92bd7e33_JaffaCakes118
Files
-
1649d51e7e0c8c1a923a46ef92bd7e33_JaffaCakes118.sys windows:4 windows x86 arch:x86
6f30d68e5d26f4f742aea057083ed2d0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitUnicodeString
RtlCopyUnicodeString
RtlAnsiStringToUnicodeString
_wcsnicmp
wcslen
wcscat
wcscpy
strncmp
swprintf
ObfDereferenceObject
_strnicmp
MmGetSystemRoutineAddress
ExFreePool
_snprintf
ExAllocatePoolWithTag
strncpy
_stricmp
IofCompleteRequest
ZwClose
ZwOpenKey
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 864B - Virtual size: 834B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ