Static task
static1
General
-
Target
68debc2fb17acfbf4bfd8595c7e7407a_JaffaCakes118
-
Size
23KB
-
MD5
68debc2fb17acfbf4bfd8595c7e7407a
-
SHA1
5a291a99c780fb118ca285b2f6f5356e94236920
-
SHA256
57e07b879306664270e1391b5d8c1a0eb8977d604eccbb55d49fe515b4d2ef60
-
SHA512
7a9b48e6a301aeb331d0faed38a80b86beb0a8f1d245241a6d31b1f5a12be94fd13349e409da60a80a284e7706ca8c98c0e88a9066ca6233ed38b6831c7828ba
-
SSDEEP
384:i0Xx1Sq5Qlg5IfDaKNg6QxLbSkf7tOwRZOYSkvYtO8HVAijxRVIIFE61Ze9E0FEx:i0fug5MBmZX9RZOYSkvYBVvjxRDFE6b1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 68debc2fb17acfbf4bfd8595c7e7407a_JaffaCakes118
Files
-
68debc2fb17acfbf4bfd8595c7e7407a_JaffaCakes118.sys windows:4 windows x86 arch:x86
6fead867313e58294b3b33649d803610
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeQuerySystemTime
ZwQueryDirectoryFile
NtSetQuotaInformationFile
wcsncmp
KeAcquireSpinLockAtDpcLevel
IoAttachDeviceToDeviceStack
_wcsicmp
ExFreePool
PsGetVersion
RtlDeleteRange
ZwQueryInformationProcess
KeIsExecutingDpc
MmUnmapViewOfSection
RtlLookupElementGenericTableFull
KefReleaseSpinLockFromDpcLevel
ExInterlockedAddLargeInteger
ZwDeleteValueKey
FsRtlUninitializeLargeMcb
ZwDeleteKey
mbtowc
ExInitializePagedLookasideList
ExAllocatePool
KeReleaseMutex
RtlUpperChar
ExInterlockedInsertTailList
CcPrepareMdlWrite
ZwQueryDefaultLocale
CcSetLogHandleForFile
FsRtlCopyWrite
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ILIT Size: 1024B - Virtual size: 614B
IMAGE_SCN_MEM_READ
.bac Size: 512B - Virtual size: 260B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cab Size: 512B - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 586B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 34B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ