Static task
static1
General
-
Target
d56a77bc88ffba14f068b0e029b4b40c_JaffaCakes118
-
Size
52KB
-
MD5
d56a77bc88ffba14f068b0e029b4b40c
-
SHA1
24555caa44dfcd08216ee9205117d5d9435d3c0d
-
SHA256
6258f6fde5762e4481294bf9979228bafa4c78264aa526137164128f7b34c473
-
SHA512
c126c18db6b0dfbb07a3b6ccd05458a597ce0edad49fbd0c24aef128d3d8ef869ceda889beada9831fafa8108997bda3935cde5dd0d6efd9ae4719cc2510e05a
-
SSDEEP
1536:nvMGb2oGpVSpXUMJANeNy/akwSjldN+alzSKGQMom049f6qpK:viDi5NsarVfs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d56a77bc88ffba14f068b0e029b4b40c_JaffaCakes118
Files
-
d56a77bc88ffba14f068b0e029b4b40c_JaffaCakes118.sys windows:4 windows x86 arch:x86
85e145eb51847cac053c20ad4ab7e6d9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
wcsstr
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
_except_handler3
KeDelayExecutionThread
PsCreateSystemThread
ZwSetValueKey
ExFreePool
wcscat
wcscpy
ZwEnumerateKey
ExAllocatePoolWithTag
ZwDeleteValueKey
_wcsnicmp
wcslen
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
MmGetSystemRoutineAddress
wcsncmp
towlower
RtlCopyUnicodeString
strncmp
IoGetCurrentProcess
PsGetVersion
strncpy
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
IofCompleteRequest
_strnicmp
IoRegisterDriverReinitialization
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 288B - Virtual size: 259B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 992B - Virtual size: 982B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ