Static task
static1
General
-
Target
c174b4772c962f835b95264ec851ad60_JaffaCakes118
-
Size
24KB
-
MD5
c174b4772c962f835b95264ec851ad60
-
SHA1
38df55d8c99ff4be5bec20ca7713e607f92891ef
-
SHA256
8827886f19ff518ff879afc9ed5b99568e3f481c1a3ff875ca25efd8c4cd2196
-
SHA512
d169ab4b8c5e004d39694956d6d3b682a04cc09f1b3663a48214bccf9db81a02f1c231a44d2d068cc161d4d7f1876ceb5704081cc38c988013be9817e7e8bc83
-
SSDEEP
384:jVFYF2Fy9FbW/0D7Nj+BbnU4haqfqIo8Zlcu3s1ucJBfMdC+up9DTvR2Q5gztZzV:j82Fy9FbW/03NiBI+tf9lf81ucJBfSC0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c174b4772c962f835b95264ec851ad60_JaffaCakes118
Files
-
c174b4772c962f835b95264ec851ad60_JaffaCakes118.sys windows:5 windows x86 arch:x86
962a625b3d7451c1b845fd7477f938c0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
wcsstr
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
_except_handler3
ExFreePool
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ExAllocatePoolWithTag
ZwQueryInformationFile
ZwCreateFile
strncmp
IoGetCurrentProcess
PsGetVersion
strncpy
ZwDeleteValueKey
KeDelayExecutionThread
PsCreateSystemThread
_wcsnicmp
wcslen
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
_strnicmp
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
KeServiceDescriptorTable
ZwSetValueKey
IofCompleteRequest
wcscat
wcscpy
ZwEnumerateKey
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IoRegisterDriverReinitialization
wcsncmp
towlower
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 896B - Virtual size: 848B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ