Static task
static1
General
-
Target
67446d0b6bf5697f97e1257838eb6ec0_JaffaCakes118
-
Size
28KB
-
MD5
67446d0b6bf5697f97e1257838eb6ec0
-
SHA1
5b2375038e6d6f38d60601ab0da4daffc44f7150
-
SHA256
6e1b1bff2a24bba3fdc3f4be6cd45be0abc79b629ca6e31c36c5be79dabff359
-
SHA512
cb4af658da23e8068af5ad7a97bc5d7ca09c66ea8598cf2682d9225a0a44ac4dc4640eb28ad8986468735145083f17441f71397426ca3f79acbddb8ad5c43625
-
SSDEEP
384:AckoJHFSUwK3D9rBoHEC9IQ1xiE8p3HuW9FdR5vi4:AckoJHcUwSmkC9ILE8p+h
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 67446d0b6bf5697f97e1257838eb6ec0_JaffaCakes118
Files
-
67446d0b6bf5697f97e1257838eb6ec0_JaffaCakes118.sys windows:4 windows x86 arch:x86
f85d353794a70ab5d6b82b1c29e5beae
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_wcsnicmp
wcslen
RtlInitUnicodeString
_stricmp
MmIsAddressValid
ZwClose
IofCompleteRequest
ExFreePool
_snprintf
ExAllocatePoolWithTag
ZwQuerySystemInformation
swprintf
wcscat
wcscpy
strncpy
RtlCopyUnicodeString
_except_handler3
ZwUnmapViewOfSection
IoGetCurrentProcess
strncmp
ObfDereferenceObject
ObQueryNameString
_strnicmp
RtlAnsiStringToUnicodeString
MmGetSystemRoutineAddress
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
RtlCompareUnicodeString
ExGetPreviousMode
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 736B - Virtual size: 724B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ