Static task
static1
General
-
Target
b3274d980d852fdb6c7efcbaf4711fb8_JaffaCakes118
-
Size
27KB
-
MD5
b3274d980d852fdb6c7efcbaf4711fb8
-
SHA1
47a7c8f5c8196fdc06687c5121207a2ca7d2b9a6
-
SHA256
564c4d31b2dd1b5fd838410b882cdf52b83e1d42c112dbfd774807be5f93e99b
-
SHA512
387652164dd02f6fecc3a39fa5fbcd53611a5f02d3559e08d855431bb24cbdf3cffe4b2bb7c2cb581dcf71552412de73d1f5f1d39d547dd602565493b894b15b
-
SSDEEP
768:bBE0DrUpRJKWd5Hqa6JSqC3Uf/0x0zO0:bwKsyj/pzH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b3274d980d852fdb6c7efcbaf4711fb8_JaffaCakes118
Files
-
b3274d980d852fdb6c7efcbaf4711fb8_JaffaCakes118.sys windows:4 windows x86 arch:x86
392fe05fecb6753654e703c92adddfcb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExFreePool
_snprintf
ExAllocatePoolWithTag
ZwQuerySystemInformation
_stricmp
RtlInitUnicodeString
swprintf
ZwClose
MmGetSystemRoutineAddress
ZwUnmapViewOfSection
strncmp
IoGetCurrentProcess
ObfDereferenceObject
ObQueryNameString
wcscpy
_except_handler3
wcscat
RtlAnsiStringToUnicodeString
_strnicmp
IofCompleteRequest
strncpy
KeServiceDescriptorTable
MmIsAddressValid
_wcsnicmp
wcslen
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
RtlCopyUnicodeString
RtlCompareUnicodeString
ExGetPreviousMode
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 768B - Virtual size: 756B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ