Static task
static1
General
-
Target
18e6682b1fafbfa7d894599042dc3d98_JaffaCakes118
-
Size
7KB
-
MD5
18e6682b1fafbfa7d894599042dc3d98
-
SHA1
6d9bcec96d644085491f7e26efcdce466341a41b
-
SHA256
fbd3d095d9bc6506292e95912674c3c53c838ac12494f633e49da671aa7b067d
-
SHA512
86920f6b316af0e2c6add54e3e8b242e34ab3838b2e29d55a45d1a10f6c39203e70f485bd14fe080a89adce7462cf4f3a6909203c28f176e000186519fcb5fb2
-
SSDEEP
96:vj/uiZKg9PBmKZM/lk6V7MKWxUUbygbiHmcPctHpB8nWX4fM2LsA8yWTaZCTAZ20:NhbilkyVWqx9lPcFpB4c4fbsA8d+ZLt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 18e6682b1fafbfa7d894599042dc3d98_JaffaCakes118
Files
-
18e6682b1fafbfa7d894599042dc3d98_JaffaCakes118.sys windows:4 windows x86 arch:x86
9f4ab0b8da4db90ba54fe1ed338e3a69
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
wcsstr
ZwQueryValueKey
memset
ZwOpenKey
RtlInitUnicodeString
ExFreePool
wcscat
wcscpy
ZwEnumerateKey
ExAllocatePoolWithTag
KeDelayExecutionThread
_strnicmp
strlen
ZwWriteFile
strcat
strcpy
ZwSetInformationFile
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
wcslen
strncmp
IoGetCurrentProcess
_wcsnicmp
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
PsGetVersion
IoRegisterDriverReinitialization
IofCompleteRequest
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsCreateSystemThread
DbgPrint
memcpy
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
ZwSetValueKey
KeServiceDescriptorTable
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 192B - Virtual size: 182B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 832B - Virtual size: 773B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 1020B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 64B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 484B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ