Static task
static1
General
-
Target
eafa3d015e694c0040c888775d04b18f_JaffaCakes118
-
Size
33KB
-
MD5
eafa3d015e694c0040c888775d04b18f
-
SHA1
1f58556bad8b8e1518a2207c12ee13d59e32feb0
-
SHA256
da8e8600adec493a2d6f8a7af638ed8fd6e4f3a501b1c51ddfe47efbdded0ec1
-
SHA512
f5fca2d8b3b9ad1544d40873ac933768926f64d7369826cf2c9b30986bc1f6752d4c86984bb1edd78295d8de224d43f131d32c8e3b3a49214edaf2d8f96c432e
-
SSDEEP
768:LeEuQ4HqNuPUMoWr7F+brvhH5TNJvLwsmonCJvd5v9m4Ev9vhkihyhVKZke/I2r:LhB4KUPU3Wr7FYrvhH1NJzwsmonCJl5k
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eafa3d015e694c0040c888775d04b18f_JaffaCakes118
Files
-
eafa3d015e694c0040c888775d04b18f_JaffaCakes118.sys windows:4 windows x86 arch:x86
a826131625caa36a8ebbbd2dfc6c50c5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IofCompleteRequest
srand
atol
islower
IoGetCurrentProcess
toupper
wcsncmp
wcslen
towlower
strchr
tolower
strstr
isdigit
isupper
strrchr
ZwClose
ZwCreateFile
RtlInitUnicodeString
IoRegisterDriverReinitialization
strncmp
isxdigit
PsGetVersion
isprint
atoi
strncpy
ZwQueryValueKey
ZwOpenKey
_except_handler3
ExFreePool
wcscpy
ZwEnumerateKey
wcscat
ExAllocatePoolWithTag
KeDelayExecutionThread
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
KeServiceDescriptorTable
ZwSetValueKey
isspace
_wcsnicmp
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsCreateSystemThread
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ZwQueryInformationFile
_strnicmp
wcsstr
ZwDeleteValueKey
Sections
.text Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ