Static task
static1
General
-
Target
2961a9364ac84303a6684a2e558c94db_JaffaCakes118
-
Size
28KB
-
MD5
2961a9364ac84303a6684a2e558c94db
-
SHA1
c45ff04a0324eb0f5b0c9c02bcbbd2e9d9cdeb5a
-
SHA256
3cfac73fbef78fd8503fa59e392842185ee488fcfbb8b5381300cca031cb3975
-
SHA512
2b95e25dd6a42379f05ba2f0ecb5184bb841808b001965d546eea1e60b98ebfcb01b1395bf848ddd6d7c627d43e0476cd9ca07f465e5c2fbfdcc00637d44e9bb
-
SSDEEP
768:vroiAhj0ayg4w5SxZxBKZNzmbTu4Ai8F1h:vroSaD4w5SrKPzmbTus8N
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2961a9364ac84303a6684a2e558c94db_JaffaCakes118
Files
-
2961a9364ac84303a6684a2e558c94db_JaffaCakes118.sys windows:4 windows x86 arch:x86
8f4d7ace58dc41ffeee26ad5fcdb8880
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlAnsiStringToUnicodeString
_stricmp
strncpy
_strnicmp
RtlInitUnicodeString
IofCompleteRequest
wcslen
ZwClose
ZwOpenKey
RtlCopyUnicodeString
ObfDereferenceObject
wcscat
wcscpy
strncmp
swprintf
ExFreePool
_snprintf
ExAllocatePoolWithTag
_wcsnicmp
_except_handler3
MmGetSystemRoutineAddress
_itow
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 928B - Virtual size: 898B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ