Static task
static1
General
-
Target
c78be5f7de07b9437a297b7e9484696b_JaffaCakes118
-
Size
8KB
-
MD5
c78be5f7de07b9437a297b7e9484696b
-
SHA1
19b530faa25706cf6ccf77b3fab321b43ae7d858
-
SHA256
79e39d164822e1655b20b6864c7e587b9643f1ba6ae9ada62e69b535a31f025d
-
SHA512
0353a4a3c30e9aaef65c0caf90a0773d6fdfff6031cab3e8a814c8cfa25c7366e83ddb24567f4e42be9de803a6345d3e24d665ac5e5ed82a7e6b92fffe396150
-
SSDEEP
192:6HH44BZGNfSrzhAhwIZMMo2EC7DAeYJWId1IrDi+O7:2Y4G4RWwIZMzgX7YcA7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c78be5f7de07b9437a297b7e9484696b_JaffaCakes118
Files
-
c78be5f7de07b9437a297b7e9484696b_JaffaCakes118.sys windows:5 windows x86 arch:x86
804dac3a369b2e8e458ae9601f763935
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
MmIsAddressValid
KeAttachProcess
PsLookupProcessByProcessId
_except_handler3
wcscmp
ExAllocatePoolWithTag
strncpy
ZwDeviceIoControlFile
ZwQueryDirectoryFile
ExFreePool
strncat
ZwQuerySystemInformation
ZwEnumerateKey
ZwCreateKey
ZwSetValueKey
strncmp
IoGetCurrentProcess
KeDetachProcess
RtlFreeAnsiString
RtlCompareMemory
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
IofCompleteRequest
PsGetVersion
ZwMapViewOfSection
ZwClose
ZwCreateSection
ZwOpenFile
RtlAnsiStringToUnicodeString
ZwUnmapViewOfSection
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
ProbeForRead
wcsstr
_stricmp
ObfDereferenceObject
hal
KfRaiseIrql
KfLowerIrql
KeGetCurrentIrql
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 352B - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 192B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 544B - Virtual size: 516B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ