Static task
static1
General
-
Target
d517f20e9f3e763baa3f7bf92dddb4b4_JaffaCakes118
-
Size
52KB
-
MD5
d517f20e9f3e763baa3f7bf92dddb4b4
-
SHA1
af102b1e127f694ad4736d9632a195ca33d4b798
-
SHA256
c1d9704dee66e7822c2ea8bbfb94ffcb3a758b674f23bd23a251fdf9e6de7133
-
SHA512
72c2a62ded686ae1e5c52f0630ad5f221acab4a57903b391f9fff0cd92fc6bf768928916491476ec6ba7c025976017084fd2d6788ca3bcc682025398d98d0e88
-
SSDEEP
1536:myo5nSS6UGd/nRuIO5TLfx7UL6IS2HZLtUfJd:mcNUGd/nRuIO5TLJ7UL6IptUfJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d517f20e9f3e763baa3f7bf92dddb4b4_JaffaCakes118
Files
-
d517f20e9f3e763baa3f7bf92dddb4b4_JaffaCakes118.sys windows:4 windows x86 arch:x86
3a04c9abb2f45624b9873b7cc9b32301
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
wcsstr
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
_except_handler3
_wcsnicmp
wcslen
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
MmGetSystemRoutineAddress
wcscat
wcscpy
PsCreateSystemThread
RtlCopyUnicodeString
ZwCreateFile
IoRegisterDriverReinitialization
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
IoGetCurrentProcess
ExGetPreviousMode
ZwSetValueKey
PsGetVersion
ExFreePool
ExAllocatePoolWithTag
strncmp
strncpy
KeDelayExecutionThread
_strnicmp
ZwDeleteValueKey
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ZwQueryInformationFile
IofCompleteRequest
ZwEnumerateKey
wcsncmp
towlower
Sections
.text Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 224B - Virtual size: 217B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 992B - Virtual size: 982B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ