Static task
static1
General
-
Target
19a34ac341082c637597fb49d887bdeb_JaffaCakes118
-
Size
26KB
-
MD5
19a34ac341082c637597fb49d887bdeb
-
SHA1
ec3ba3b607aae250fc3977e07895556d09e460b7
-
SHA256
03ec3545ee27c5fd9dfb2949a49ba8594d70f53158295f4473224ba84b0cee78
-
SHA512
c6cbc5d7ea3280e83553a1ea01d8fd85e190d9b44adfefac42ed0ba10c503163edf90ece4b31e67c5cd9b5e87278092e4b82c72c680732e24874ead5088ff0bc
-
SSDEEP
384:13jj03C61UH9Z8oGx8K4+tWwwuUQWh5ceVi03GVQxWKwsuMKalpkdV34XrU8kAc/:1T2m9rGSQWrcebQaAd9OYCHYMHv1U
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 19a34ac341082c637597fb49d887bdeb_JaffaCakes118
Files
-
19a34ac341082c637597fb49d887bdeb_JaffaCakes118.sys windows:5 windows x86 arch:x86
58f7f6ec7c52de9c47d4a94978d72f9e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_strnicmp
wcsncmp
wcslen
towlower
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ZwClose
PsCreateSystemThread
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
IoGetCurrentProcess
ExGetPreviousMode
KeServiceDescriptorTable
ZwSetValueKey
PsGetVersion
ExFreePool
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ExAllocatePoolWithTag
ZwQueryInformationFile
ZwCreateFile
wcscpy
ZwEnumerateKey
wcscat
ZwOpenKey
wcsstr
ZwQueryValueKey
_except_handler3
strncmp
strncpy
IoRegisterDriverReinitialization
IofCompleteRequest
ZwDeleteValueKey
KeDelayExecutionThread
_wcsnicmp
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 800B - Virtual size: 788B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ