Static task
static1
General
-
Target
baf78a68d6ae91643c9bfc2e93b229d0_JaffaCakes118
-
Size
48KB
-
MD5
baf78a68d6ae91643c9bfc2e93b229d0
-
SHA1
fd2f9da2da125e8a0c2c1b6301a4bbc8fefea9e7
-
SHA256
58edec7a9f6e8e5d437104e369ecba2957418ef0790c5e7c37d3182428ecb968
-
SHA512
0776d4c8d9a3a22d7eb36a248dbe7434014c97e2a7fcbc2360c175aa850fc0697bd9ef1dd1573ea31284e32a50c3c74e7ce07dce4f09e079912fe1b7a3a989c8
-
SSDEEP
768:7aCOB0yNt5QNqF3YKMp1KBl6252BnrC/iYxayxVyKT+jDD5P2pIJdwT5yw6CJfMo:60RZYUj/2nxdrEnro
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource baf78a68d6ae91643c9bfc2e93b229d0_JaffaCakes118
Files
-
baf78a68d6ae91643c9bfc2e93b229d0_JaffaCakes118.sys windows:4 windows x86 arch:x86
72965b3594fb9af91c6060cb5a1e2ffa
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
swprintf
MmGetSystemRoutineAddress
RtlInitUnicodeString
ZwCreateKey
wcslen
wcscat
wcscpy
PsTerminateSystemThread
_stricmp
strncpy
PsLookupProcessByProcessId
ExAllocatePoolWithTag
KeInitializeTimer
IofCompleteRequest
MmIsAddressValid
ZwCreateFile
ZwSetValueKey
ZwOpenKey
ZwEnumerateKey
_snprintf
ExFreePool
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
PsGetVersion
_wcslwr
wcsncpy
ZwUnmapViewOfSection
strncmp
IoGetCurrentProcess
_wcsnicmp
RtlAnsiStringToUnicodeString
IoRegisterDriverReinitialization
Sections
.text Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 192B - Virtual size: 175B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 832B - Virtual size: 804B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 928B - Virtual size: 912B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 736B - Virtual size: 722B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ