Static task
static1
General
-
Target
ae63d86976494bd73fda7f404c5e4036_JaffaCakes118
-
Size
52KB
-
MD5
ae63d86976494bd73fda7f404c5e4036
-
SHA1
a56e37683a937fa59b7f96932739da6a30d82ecf
-
SHA256
52e526a4bec7d61f9c16a2f7fc86a6621efa0e0298a67a570187be0d54110c49
-
SHA512
2bf96a3ed5bdf3366599109cf02e6593e3f59b635b59fbdd2fc28300d792c0e1a9e98139dc179c6f2256a0344cefddd9fb458f137a2601ac9660a28e85df84f6
-
SSDEEP
768:pxZ77bmNbH6GFIdBHdVrCJ0UwF+1ISbS9bqxWy7:pxZfy4mI3HdBKRS9bqxWy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ae63d86976494bd73fda7f404c5e4036_JaffaCakes118
Files
-
ae63d86976494bd73fda7f404c5e4036_JaffaCakes118.sys windows:4 windows x86 arch:x86
afbe502d5c8f0f42f31bf6d9de507bbd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwCreateFile
RtlInitUnicodeString
IoRegisterDriverReinitialization
_strnicmp
KeDelayExecutionThread
PsCreateSystemThread
ZwSetValueKey
ZwQueryValueKey
ZwOpenKey
_wcsnicmp
wcslen
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
wcsstr
_except_handler3
ExFreePool
wcscpy
ZwEnumerateKey
wcscat
ExAllocatePoolWithTag
MmGetSystemRoutineAddress
RtlCopyUnicodeString
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
IoGetCurrentProcess
ExGetPreviousMode
PsGetVersion
ZwDeleteValueKey
strncmp
strncpy
wcsncmp
towlower
IofCompleteRequest
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ZwQueryInformationFile
Sections
.text Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 224B - Virtual size: 211B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 992B - Virtual size: 982B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ