Static task
static1
General
-
Target
28a87e69ee7b70997e264316dc0c6fe5_JaffaCakes118
-
Size
53KB
-
MD5
28a87e69ee7b70997e264316dc0c6fe5
-
SHA1
6aedc4ad0121c0ff0326b4dea3d79e034b892490
-
SHA256
2e8ae66de0467b1ff2ee0bc44cf497eb5cb891560d2ac56a2fd02ddfdfa06e35
-
SHA512
0ab931eb3a33ca83e27d8944d83868752eccb6f3e8133e4cd11b9788483c10a5fd5ae173e0b924400ef1ea644c145ca437e16a4fe5c8636ffd06baa77a988fef
-
SSDEEP
768:X2gqSsZPYNensWZp1uiR10Y7Cwgkwu4a282x8STsW+atrpAcUpmtw+0AZe1anjP:wSOwkBdF7AkSR576Aj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 28a87e69ee7b70997e264316dc0c6fe5_JaffaCakes118
Files
-
28a87e69ee7b70997e264316dc0c6fe5_JaffaCakes118.sys windows:4 windows x86 arch:x86
c935f481708e0a81a53a0ff97400c4f4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IofCompleteRequest
IoGetCurrentProcess
strncmp
PsGetVersion
strncpy
_strnicmp
MmGetSystemRoutineAddress
RtlInitUnicodeString
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
ZwSetValueKey
ExFreePool
ExAllocatePoolWithTag
ZwClose
ZwQueryValueKey
ZwOpenKey
_except_handler3
_wcsnicmp
wcslen
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
wcscpy
ZwEnumerateKey
wcscat
PsCreateSystemThread
RtlCopyUnicodeString
ZwDeleteValueKey
KeDelayExecutionThread
ZwCreateFile
IoRegisterDriverReinitialization
wcsncmp
towlower
wcsstr
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ZwQueryInformationFile
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 320B - Virtual size: 291B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 992B - Virtual size: 982B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ