Static task
static1
General
-
Target
4813e26b08b32eac2e2de1b9f44ee2e2_JaffaCakes118
-
Size
22KB
-
MD5
4813e26b08b32eac2e2de1b9f44ee2e2
-
SHA1
265faa49a2b32764907d64a2259037fdc2cdf207
-
SHA256
b7fd79a5ffc7e025ed5f60f282c61314b53b604b94a7fe5e27122747763320ae
-
SHA512
d14996a46315c71e98349d9ad7be15d3459d5271ae2d6f9497d052838ee504e3973baab0b04e4fcf30df8625c8b905cc63837ba0e0e58c729a7ef7fcf21347d7
-
SSDEEP
384:9Y1r17qf6lg5IfDaKNg6QxLbSkf7tOwRZ0nv8/VAijxRVIIFE61Ze9E0lrmD:9YaSg5MBmZX9RZ0nv8/VvjxRDFE6bIEg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4813e26b08b32eac2e2de1b9f44ee2e2_JaffaCakes118
Files
-
4813e26b08b32eac2e2de1b9f44ee2e2_JaffaCakes118.sys windows:4 windows x86 arch:x86
6fead867313e58294b3b33649d803610
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeQuerySystemTime
ZwQueryDirectoryFile
NtSetQuotaInformationFile
wcsncmp
KeAcquireSpinLockAtDpcLevel
IoAttachDeviceToDeviceStack
_wcsicmp
ExFreePool
PsGetVersion
RtlDeleteRange
ZwQueryInformationProcess
KeIsExecutingDpc
MmUnmapViewOfSection
RtlLookupElementGenericTableFull
KefReleaseSpinLockFromDpcLevel
ExInterlockedAddLargeInteger
ZwDeleteValueKey
FsRtlUninitializeLargeMcb
ZwDeleteKey
mbtowc
ExInitializePagedLookasideList
ExAllocatePool
KeReleaseMutex
RtlUpperChar
ExInterlockedInsertTailList
CcPrepareMdlWrite
ZwQueryDefaultLocale
CcSetLogHandleForFile
FsRtlCopyWrite
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ILIT Size: 1024B - Virtual size: 614B
IMAGE_SCN_MEM_READ
.bac Size: 512B - Virtual size: 260B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cab Size: 512B - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 336B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 34B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ