Static task
static1
General
-
Target
aee470f40289681f6b7fad28d86a84b5_JaffaCakes118
-
Size
27KB
-
MD5
aee470f40289681f6b7fad28d86a84b5
-
SHA1
495cc9cfd95e793e71a402aabbb1baeaf06948d4
-
SHA256
b6e28e9865de33f11d8a50f4e63cf092c1d231bdef4ec24dc41586ffeccd4071
-
SHA512
91c2eccef82e16265ffb4ab1328dc08a70d79d7bd3d2d8569408f600ac783267ea9f6edc3e2a5d92a68fae5163b473c39b0dd5a5245313cc234b23186c6bf1d4
-
SSDEEP
768:zpvm259UhcipkEg5ISkry4p67EXwY7S2JeyEiBYJ1zXVqBoiGW:F5azQiHizkBoiGW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aee470f40289681f6b7fad28d86a84b5_JaffaCakes118
Files
-
aee470f40289681f6b7fad28d86a84b5_JaffaCakes118.sys windows:4 windows x86 arch:x86
f30dc93cb3afe9a28c82aa114bfd767b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
MmIsAddressValid
ObfDereferenceObject
ObQueryNameString
ZwMapViewOfSection
ZwClose
ZwCreateSection
ZwOpenFile
RtlInitUnicodeString
ExFreePool
ExAllocatePoolWithTag
_snprintf
ZwQuerySystemInformation
wcscpy
wcscat
MmGetSystemRoutineAddress
swprintf
ZwUnmapViewOfSection
KeServiceDescriptorTable
RtlCopyUnicodeString
_wcsnicmp
wcslen
_except_handler3
RtlAnsiStringToUnicodeString
_stricmp
strncpy
IofCompleteRequest
strncmp
IoGetCurrentProcess
RtlCompareUnicodeString
ExGetPreviousMode
_strnicmp
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 768B - Virtual size: 756B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ