Static task
static1
General
-
Target
8764f0f62d3d06c6e10568e21f80d4f5_JaffaCakes118
-
Size
30KB
-
MD5
8764f0f62d3d06c6e10568e21f80d4f5
-
SHA1
677c579d7905f46b062e6aef062b65354d09f2a5
-
SHA256
84714433bd2cb38aaefce0fbc43808b5bf22058ad99f32cc8230df5b80cf5ee1
-
SHA512
011476cb4caba655eedbd3968153a06fefe0888ede0d8d3b165140514d4747d6b633c191339799550682cbfae5ed67ebfe054ecc0b076cb13d672302f0559e9e
-
SSDEEP
768:/H2ur1/ec2NNMWCY9AIAhoRX90ew4mHCZwTFF5hOIX7B/iv2/S+UPDLy:/WS1KNKe9ADqxueZ++a5hOO7EvS8DL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8764f0f62d3d06c6e10568e21f80d4f5_JaffaCakes118
Files
-
8764f0f62d3d06c6e10568e21f80d4f5_JaffaCakes118.sys windows:5 windows x86 arch:x86
a2fb5fb1e4a50993928951a7d6c8fe2a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
wcsstr
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
_except_handler3
ExFreePool
wcscpy
ZwEnumerateKey
wcscat
ExAllocatePoolWithTag
KeDelayExecutionThread
strncmp
IoGetCurrentProcess
PsGetVersion
strncpy
_wcsnicmp
wcslen
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsCreateSystemThread
ZwDeleteValueKey
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
KeServiceDescriptorTable
ZwSetValueKey
wcsncmp
towlower
ZwCreateFile
IoRegisterDriverReinitialization
_strnicmp
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ZwQueryInformationFile
IofCompleteRequest
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 800B - Virtual size: 800B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ