Static task
static1
General
-
Target
865356419bdc1610047103e5fcd5cb93_JaffaCakes118
-
Size
50KB
-
MD5
865356419bdc1610047103e5fcd5cb93
-
SHA1
3a71c28ae2eea09603042a2b6d0e24e3c9ece63d
-
SHA256
568093598c60ae2d98420b8694532843aa0c43116d06c81a89397616a9a0ecb1
-
SHA512
f98244ef682ed788a9a2b83c9501f7eb61ef5a566bc820c55d809c5c2d0e1384eebd0883a28738646ee30d6b2af323c03c8c21510f3050e1d08395de0d982efa
-
SSDEEP
768:BRwN3f1cr4AAVI4S+eaoWz9VZL19FPNtURkVa:gstOI4LJomVtHFPskw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 865356419bdc1610047103e5fcd5cb93_JaffaCakes118
Files
-
865356419bdc1610047103e5fcd5cb93_JaffaCakes118.sys windows:4 windows x86 arch:x86
25402d097ab6eef6e08bd9a4e855f879
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ExFreePool
wcscpy
ZwEnumerateKey
wcscat
ExAllocatePoolWithTag
ZwOpenKey
RtlInitUnicodeString
KeDelayExecutionThread
MmGetSystemRoutineAddress
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
IoGetCurrentProcess
ExGetPreviousMode
ZwSetValueKey
PsGetVersion
ZwDeleteValueKey
_except_handler3
PsCreateSystemThread
ZwQueryValueKey
IofCompleteRequest
wcsncmp
wcslen
towlower
ZwCreateFile
IoRegisterDriverReinitialization
strncmp
strncpy
_strnicmp
wcsstr
_wcsnicmp
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ZwQueryInformationFile
Sections
.text Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 256B - Virtual size: 239B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 960B - Virtual size: 954B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 928B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ