Static task
static1
General
-
Target
c8a3ebe13ee84ba4492e024a4b1c383d_JaffaCakes118
-
Size
21KB
-
MD5
c8a3ebe13ee84ba4492e024a4b1c383d
-
SHA1
e0506e3955396fb05837374a14f6ead209f42c46
-
SHA256
96c2ba0654b99eda865a96db3242dff9d84ee8ec8e2a33b3f8e47a7590109353
-
SHA512
8ce8e5d3f563fda64ea001da581c965e0b79a8dadcd16f18d9a4f374358e255684d8fd97283e624cade8b36ebf928da73e9045a1869786a1465ea6dc968724a3
-
SSDEEP
384:LyI60OyZ7R7RB00rDfylrYZzI4VDJWHyK1aFmmL0sKOGN67+0fouvl5kmoUA6Yjn:LyI6ml7RBFfyBYFXVNQ1aFVapN66QoO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c8a3ebe13ee84ba4492e024a4b1c383d_JaffaCakes118
Files
-
c8a3ebe13ee84ba4492e024a4b1c383d_JaffaCakes118.sys windows:4 windows x86 arch:x86
e55297a3b3a16f0cd83bf823c7a9c786
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_wcsnicmp
wcslen
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
wcsncmp
towlower
isspace
strstr
isdigit
IofCompleteRequest
isprint
atoi
strrchr
IoGetCurrentProcess
ZwClose
ZwCreateFile
RtlInitUnicodeString
IoRegisterDriverReinitialization
ZwDeleteValueKey
KeDelayExecutionThread
_except_handler3
PsCreateSystemThread
ZwQueryValueKey
ZwOpenKey
_strnicmp
ExFreePool
wcscat
wcscpy
ZwEnumerateKey
ExAllocatePoolWithTag
toupper
isxdigit
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ZwQueryInformationFile
srand
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsGetVersion
isupper
islower
strchr
atol
strncmp
strncpy
wcsstr
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
KeServiceDescriptorTable
ZwSetValueKey
tolower
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 1020B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ