Static task
static1
General
-
Target
250da626b161a0aa00c61d2c26e296e6_JaffaCakes118
-
Size
21KB
-
MD5
250da626b161a0aa00c61d2c26e296e6
-
SHA1
7769266ae6f0023a34f34506e158225c8fb12b6c
-
SHA256
f3412052b47777effb96c8180d711b1e2fe25e4942a697dd512745f6c643bd2a
-
SHA512
f332466e2d3bffa7cc5c93e6d658b2932c29ab6a9b6de3abffa60d36692fee2bf4e92a342c8360939e8f636ac567ec006f22c73e25fe7961bf39f0bfb1655a9c
-
SSDEEP
384:umHkFp3b3Ew5HxZFZNn8UdJobwCczYvApB054rJZSS5mZrGgM:ZH+ph1zRW7czYvAY5IJZL5mZzM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 250da626b161a0aa00c61d2c26e296e6_JaffaCakes118
Files
-
250da626b161a0aa00c61d2c26e296e6_JaffaCakes118.sys windows:4 windows x86 arch:x86
046f9f21d0df38c15124092c87eaab3e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwDeleteKey
ExSystemExceptionFilter
RtlCustomCPToUnicodeN
FsRtlAreNamesEqual
ObQueryNameString
RtlGetSaclSecurityDescriptor
IoBuildAsynchronousFsdRequest
MmIsNonPagedSystemAddressValid
RtlFillMemoryUlong
InterlockedIncrement
WRITE_REGISTER_ULONG
ZwQueryInformationFile
IoGetInitialStack
RtlFindMessage
PsChargePoolQuota
RtlIntegerToUnicodeString
ExFreePool
ZwSaveKey
ZwQueryInformationProcess
towupper
CcUnpinData
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ILIT Size: 1024B - Virtual size: 614B
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 485B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 18B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ