Static task
static1
General
-
Target
a0f580f8bba97315f24ed067caac092a_JaffaCakes118
-
Size
54KB
-
MD5
a0f580f8bba97315f24ed067caac092a
-
SHA1
90f5d8d6c93d5f67be2a1b1f64ae4aaa40af4d5d
-
SHA256
2eaf60d26e37a8689014b17f6011dfd61b31fb7eda69a8cbd53cfce48d68a03a
-
SHA512
d59781a4b0cf60d1e88de7d1136dbea904bd7f67c4d2199da5c9f966062e2d3eb94262398749b6e22fb3813e711ba62283c24c3b0b28f6cc48d1e4c6b2f53207
-
SSDEEP
1536:mJIIBSCtDrS3ZEflDQ8I+lNQdsB5haQe9jaTOl/4c7FC/qH6KowgR7exTSJz:mJIIBSCtDrS3ZEflDQt+lNQdsvhm9jaV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a0f580f8bba97315f24ed067caac092a_JaffaCakes118
Files
-
a0f580f8bba97315f24ed067caac092a_JaffaCakes118.sys windows:4 windows x86 arch:x86
ad3effc0809946d7689172f0b16a940d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
MmGetSystemRoutineAddress
RtlInitUnicodeString
IofCompleteRequest
IoGetCurrentProcess
ExFreePool
ZwClose
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ExAllocatePoolWithTag
ZwQueryInformationFile
ZwCreateFile
wcscat
wcscpy
ZwEnumerateKey
ZwOpenKey
IoRegisterDriverReinitialization
wcsstr
ZwQueryValueKey
_except_handler3
PsCreateSystemThread
RtlCopyUnicodeString
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
ZwSetValueKey
PsGetVersion
KeDelayExecutionThread
ZwDeleteValueKey
_wcsnicmp
wcslen
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
wcsncmp
towlower
_strnicmp
strncmp
strncpy
Sections
.text Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 256B - Virtual size: 246B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 992B - Virtual size: 982B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ