Static task
static1
General
-
Target
c23a9b9a159bd96d4757c452bd8c4b09_JaffaCakes118
-
Size
51KB
-
MD5
c23a9b9a159bd96d4757c452bd8c4b09
-
SHA1
f0283c42026fa0fa0a641ebe8f6b62e5613518a7
-
SHA256
6a7bfd6f6c3d7a935ce8cfedd6de05565b9385e55174bf5001713bbd73c931ab
-
SHA512
bfb15a0966ea89d91a865a726c5d50ca568fa662edbf0c926cd516b0d6d5206a1c47b8c76e12acc4b93d7e98372cb079c768642d1a076799edfe0b087b018b7f
-
SSDEEP
768:Uxbfj6l1o8DEHp2M4WTeMx02NBM+/MuhJtZq2ZL428+jzPN+Ob9BNK/kx6HJZo5C:ybf+nLxsbPplZ7Qcn5yt6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c23a9b9a159bd96d4757c452bd8c4b09_JaffaCakes118
Files
-
c23a9b9a159bd96d4757c452bd8c4b09_JaffaCakes118.sys windows:4 windows x86 arch:x86
1e4eb5f291e286d4b784ec022026a118
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_wcsnicmp
wcslen
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
MmGetSystemRoutineAddress
RtlInitUnicodeString
wcscat
wcscpy
ZwClose
PsCreateSystemThread
wcsncmp
towlower
strncmp
IoGetCurrentProcess
PsGetVersion
strncpy
IofCompleteRequest
ZwCreateFile
IoRegisterDriverReinitialization
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
ZwSetValueKey
ExFreePool
ExAllocatePoolWithTag
ZwEnumerateKey
ZwOpenKey
KeDelayExecutionThread
_strnicmp
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ZwQueryInformationFile
ZwDeleteValueKey
_except_handler3
ZwQueryValueKey
wcsstr
Sections
.text Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 256B - Virtual size: 244B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 960B - Virtual size: 954B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ