Static task
static1
General
-
Target
703a2dfefcc944153fa358d573f8aed2_JaffaCakes118
-
Size
27KB
-
MD5
703a2dfefcc944153fa358d573f8aed2
-
SHA1
0d85e7d325ea2c92d407ef2e717d227de969a5d4
-
SHA256
a050b8923cf3acad7c9f718035dc389de3e3858d13dc21450060bdf10f3b6065
-
SHA512
9e6199fccf15a866829e390465137cf73912b5f529db12f5a610ff38b9c4b39a636b88d11bee908265a9e6349eb83ee65e3d3d53a527ab2f23878616ab923d69
-
SSDEEP
768:tRsN1Fh6X/FVmr2eN4zrZQ38as0IYgyR:/s/smX6sS0IYLR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 703a2dfefcc944153fa358d573f8aed2_JaffaCakes118
Files
-
703a2dfefcc944153fa358d573f8aed2_JaffaCakes118.sys windows:4 windows x86 arch:x86
3b23d0edaf1710ad26d91e2a47dd7b7d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwMapViewOfSection
ZwClose
ZwCreateSection
ZwOpenFile
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
MmGetSystemRoutineAddress
RtlCopyUnicodeString
ObfDereferenceObject
ObQueryNameString
_wcsnicmp
wcslen
strncmp
IoGetCurrentProcess
RtlCompareUnicodeString
swprintf
_except_handler3
ZwUnmapViewOfSection
MmIsAddressValid
_stricmp
ExFreePool
ExAllocatePoolWithTag
wcscpy
wcscat
_snprintf
ZwQuerySystemInformation
IofCompleteRequest
_strnicmp
strncpy
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 704B - Virtual size: 700B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ