Static task
static1
General
-
Target
68477aedb29a27509e9b7e97dce60f29_JaffaCakes118
-
Size
27KB
-
MD5
68477aedb29a27509e9b7e97dce60f29
-
SHA1
c0ed571fd1a1878e2a55bf1cddb56c4bae69ac2e
-
SHA256
f478ba7c86c63e96384dc9d2809b37baa7f9e87c9fbc385e5eddc22e3034dbcf
-
SHA512
32688d8a076854e5565dafb902b00479d01b8b37a4efb59c81948f54afb5f98209bca4bf40416b8b938ee4ec29e9e4a46cb6292d2f00734626abeba2ccf83916
-
SSDEEP
768:40ejYnCwe0UGUUqX9pmwR1Lm65tu3zJtUs:QjYn3UbpmwfLZkFtr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 68477aedb29a27509e9b7e97dce60f29_JaffaCakes118
Files
-
68477aedb29a27509e9b7e97dce60f29_JaffaCakes118.sys windows:4 windows x86 arch:x86
69f13772ebe4800848ab340f242f95cc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExFreePool
_snprintf
ExAllocatePoolWithTag
wcslen
wcscat
wcscpy
_except_handler3
_stricmp
strncpy
RtlInitUnicodeString
MmIsAddressValid
MmGetSystemRoutineAddress
swprintf
strncmp
_strnicmp
_wcsnicmp
_itow
RtlCopyUnicodeString
RtlAnsiStringToUnicodeString
IofCompleteRequest
ObfDereferenceObject
ZwClose
ZwOpenKey
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 928B - Virtual size: 914B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ