Static task
static1
General
-
Target
e150f3b8b67cfaf86268cd640e7965f8_JaffaCakes118
-
Size
8KB
-
MD5
e150f3b8b67cfaf86268cd640e7965f8
-
SHA1
8c87be298d6fc6c23f2e2ec130ab3b917580674b
-
SHA256
2431cf3f218711705796efdade436904284ade445e4a05d3d09c661fe7a8ff73
-
SHA512
d3fe71589aa5171fec02cd21b353e38612b2571fe50b41b7043f73c75b8321db625ff3925f84c394aee3ad458a05c450f6bdba91cb1e8acf07567b8e13b60a6b
-
SSDEEP
192:6bBSr86APeR87RHdfAOPBVs82qT4E5PGOFCh2M/uosFv:6peRknfBPB24T4A2h/utFv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e150f3b8b67cfaf86268cd640e7965f8_JaffaCakes118
Files
-
e150f3b8b67cfaf86268cd640e7965f8_JaffaCakes118.sys windows:5 windows x86 arch:x86
a32a76ab9d71a9744a41aad7421345d7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwCreateKey
ZwSetValueKey
ExFreePool
strncat
ExAllocatePoolWithTag
ZwQuerySystemInformation
wcscmp
_except_handler3
_stricmp
IoGetCurrentProcess
ZwClose
ZwUnmapViewOfSection
strncmp
PsGetVersion
strncpy
ObfDereferenceObject
ZwQueryDirectoryFile
KeAttachProcess
PsLookupProcessByProcessId
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
RtlFreeAnsiString
RtlCompareMemory
RtlUnicodeStringToAnsiString
IoCreateSymbolicLink
IoCreateDevice
IofCompleteRequest
wcslen
ZwDeviceIoControlFile
ZwEnumerateKey
KeDetachProcess
DbgPrint
hal
KfRaiseIrql
KfLowerIrql
KeGetCurrentIrql
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 320B - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 192B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 576B - Virtual size: 554B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ