Static task
static1
General
-
Target
a46e9b024155c3778866df4a85fc2a9d_JaffaCakes118
-
Size
29KB
-
MD5
a46e9b024155c3778866df4a85fc2a9d
-
SHA1
127e7a27a6d0b4ae82fa323ad3875caa26d58563
-
SHA256
69dbff03ecae47fb03a785fde20aecdbee84240dcc5335a7928d91fafa17ea38
-
SHA512
eaffeb04740a668b211e205aa27c1e3abf6e1394ea57815af245f469f826fd85eb01d768a8e7540c0fac171997058f52b44be275e1a45a4939e1a82b502d1120
-
SSDEEP
768:IeNNplKvC8yH7O2EyuYzEyiQ/+B0uGi0:5vL8wCYcQGB0Hi0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a46e9b024155c3778866df4a85fc2a9d_JaffaCakes118
Files
-
a46e9b024155c3778866df4a85fc2a9d_JaffaCakes118.sys windows:5 windows x86 arch:x86
2e8728752b8e0a8bc5ec158991a323c6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ExFreePool
wcscat
wcscpy
ZwEnumerateKey
ExAllocatePoolWithTag
ZwOpenKey
RtlInitUnicodeString
wcsstr
ZwQueryValueKey
_except_handler3
_wcsnicmp
wcslen
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
IoGetCurrentProcess
ExGetPreviousMode
KeServiceDescriptorTable
ZwSetValueKey
PsGetVersion
strncmp
strncpy
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsCreateSystemThread
ZwCreateFile
IoRegisterDriverReinitialization
ZwDeleteValueKey
KeDelayExecutionThread
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ZwQueryInformationFile
wcsncmp
towlower
IofCompleteRequest
_strnicmp
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 832B - Virtual size: 806B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ