Static task
static1
General
-
Target
43def6a709792b98194558219bc004c3_JaffaCakes118
-
Size
25KB
-
MD5
43def6a709792b98194558219bc004c3
-
SHA1
d23c29ddfc7c79900b15b81b259de6ca130b5c0d
-
SHA256
50afbefc0e1d6dcad2a81660c8d6c68ce93f8fbaa3730de55566b42e19a705f5
-
SHA512
b83f9edb6a799d39ff4f90ea90666066303bc7ba7579335ed5fb4b0630a66e1f80f45f87d26b136e4d4833e876546fa881509a63776179158a75e68036271229
-
SSDEEP
384:ZayQvsqjM/VGj1mVAy9Njyn8Yh4M/lncRNyomNgiXF+M0:4yQFjGE4AuOn8YWMaMocxXF+M0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 43def6a709792b98194558219bc004c3_JaffaCakes118
Files
-
43def6a709792b98194558219bc004c3_JaffaCakes118.sys windows:4 windows x86 arch:x86
c2495ae1d314cfd5e241db38e5196792
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoUnregisterShutdownNotification
IoSetDeviceToVerify
RtlUnicodeStringToAnsiString
ZwCreateSymbolicLinkObject
_except_handler2
RtlImageNtHeader
ObfReferenceObject
FsRtlGetNextFileLock
ZwQueryInformationProcess
KdDebuggerEnabled
RtlInitString
memset
MmFreeNonCachedMemory
RtlFreeUnicodeString
ZwDisplayString
ExFreePool
KeInsertQueueDpc
ZwDeleteKey
CcFastMdlReadWait
ZwQueryDirectoryObject
PsSetLoadImageNotifyRoutine
RtlRealPredecessor
strcpy
FsRtlUninitializeFileLock
wcslen
NlsLeadByteInfo
RtlAnsiStringToUnicodeString
RtlCompareUnicodeString
RtlUpperChar
strcmp
NtCreateSection
KeQuerySystemTime
MmUnmapVideoDisplay
KeSetKernelStackSwapEnable
ExAllocatePool
RtlGetFirstRange
ZwLoadKey
ExAcquireFastMutexUnsafe
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 590B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Ldata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_MEM_READ
.Gdata Size: 1024B - Virtual size: 772B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ