Static task
static1
General
-
Target
69bb422f989f0b91731b38ece45b2789_JaffaCakes118
-
Size
7KB
-
MD5
69bb422f989f0b91731b38ece45b2789
-
SHA1
7e1590afb7cfea202763abe13b4c93101413c60c
-
SHA256
00de3129a1042b883bd193e371350e5b69450cb4dbec67998da1f0faa1d33be1
-
SHA512
bffd2be388c752f312fab2713aa8e1b85c0f59e8aee51f0e6c43e4f3577f3554c967554d414c0b00105fa4ed5f76fabfd0d8eec119ebf17f7c17135421afa010
-
SSDEEP
96:vjos4bsRsFfjKKWaLf4becjG6Iizs//Yz2rgcjccgLZ2w7NsT:cbscrrjGG6IizspEte
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 69bb422f989f0b91731b38ece45b2789_JaffaCakes118
Files
-
69bb422f989f0b91731b38ece45b2789_JaffaCakes118.sys windows:4 windows x86 arch:x86
66d883e8ff08322078763d8f40a74166
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
wcsstr
ZwQueryValueKey
memset
ZwOpenKey
RtlInitUnicodeString
ExFreePool
wcscpy
wcscat
ZwEnumerateKey
ExAllocatePoolWithTag
KeDelayExecutionThread
_strnicmp
strlen
ZwWriteFile
strcat
strcpy
ZwSetInformationFile
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
wcslen
strncmp
IoGetCurrentProcess
_wcsnicmp
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
PsGetVersion
IoRegisterDriverReinitialization
IofCompleteRequest
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsCreateSystemThread
DbgPrint
memcpy
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
ZwSetValueKey
KeServiceDescriptorTable
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 206B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 832B - Virtual size: 785B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 1020B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 64B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 484B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ