Static task
static1
General
-
Target
e24241c02c9bc5fc34d38984d41c8dfe_JaffaCakes118
-
Size
24KB
-
MD5
e24241c02c9bc5fc34d38984d41c8dfe
-
SHA1
96b31b8bc5a917bce4ebef8bf6c7d856ffa8b9b7
-
SHA256
e6ba459646a70be10148aaec95371f0bc11e77ae940d126970a25c9f6efbc37b
-
SHA512
650ab91ee374bacc909e536e36e7b0dc877f13e87e6e5ea9745cb1d2499fa07e5fa62bc8e8f9478b173980236e6340c844ced936823f5c04598ea0b2027a4921
-
SSDEEP
384:6xaHMt1QCEatdBWWZ68Nfb35E62kmV7HBUOZw92ggcOD56:6xaHxmriyaz76OZw92g4D
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e24241c02c9bc5fc34d38984d41c8dfe_JaffaCakes118
Files
-
e24241c02c9bc5fc34d38984d41c8dfe_JaffaCakes118.sys windows:5 windows x86 arch:x86
5d5f9c5941b6a8ef8ced6c159d8fcff3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
MmIsAddressValid
strncmp
IoGetCurrentProcess
_wcsnicmp
wcslen
ZwClose
ZwUnmapViewOfSection
RtlInitUnicodeString
PsTerminateSystemThread
KeDelayExecutionThread
PsCreateSystemThread
wcscat
wcscpy
_stricmp
strncpy
PsLookupProcessByProcessId
ExAllocatePoolWithTag
KeInitializeTimer
IofCompleteRequest
PsGetVersion
_wcslwr
wcsncpy
swprintf
ZwCreateKey
RtlAnsiStringToUnicodeString
ZwCreateFile
IoRegisterDriverReinitialization
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
_snprintf
ExFreePool
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
ZwSetValueKey
ZwOpenKey
ZwEnumerateKey
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 960B - Virtual size: 958B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 608B - Virtual size: 604B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ