Static task
static1
General
-
Target
b8babf790a1c42fb41fb586674fd44bd_JaffaCakes118
-
Size
52KB
-
MD5
b8babf790a1c42fb41fb586674fd44bd
-
SHA1
b0999acff84da49076a50fc5a41640dad2ce1afa
-
SHA256
2713bf3fcd71230a33fbf4a253b9a412122b420b8056dfe18179c4a353704fd3
-
SHA512
1aca4f140c419b9b2fe728c2b198cc08889e9bcd0c15d17c9af12169c125db560d1d43f1f2e179f53b2ddb2c7854dd86f305fa0810dbe54bd5fc9203c4d609c0
-
SSDEEP
1536:jOqVrqSjqisEBLLLku4ckLfU9o8Cj1JpZL0V48Dbu:jj+dgV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b8babf790a1c42fb41fb586674fd44bd_JaffaCakes118
Files
-
b8babf790a1c42fb41fb586674fd44bd_JaffaCakes118.sys windows:4 windows x86 arch:x86
a1b64412c46071c6a3c5cd084438753d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwCreateFile
RtlInitUnicodeString
IoRegisterDriverReinitialization
wcsncmp
wcslen
towlower
IofCompleteRequest
IoGetCurrentProcess
ZwDeleteValueKey
KeDelayExecutionThread
_except_handler3
PsCreateSystemThread
ZwQueryValueKey
ZwOpenKey
ExFreePool
wcscpy
ZwEnumerateKey
wcscat
ExAllocatePoolWithTag
MmGetSystemRoutineAddress
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
ZwSetValueKey
PsGetVersion
wcsstr
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ZwQueryInformationFile
RtlCopyUnicodeString
_strnicmp
strncmp
strncpy
_wcsnicmp
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
Sections
.text Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 288B - Virtual size: 270B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 992B - Virtual size: 982B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ