Static task
static1
General
-
Target
eea811fb924c38ed67895696d1847394_JaffaCakes118
-
Size
51KB
-
MD5
eea811fb924c38ed67895696d1847394
-
SHA1
517f24e4bc80201d940ca1353308bef851844b3d
-
SHA256
c397c58b3e61668482b21b6116e1507ff2a85aa61cf934879b29ab6401821688
-
SHA512
6a0d3dd5a826d40e15e5489bed383b38bde63e460b0e8bfd5ebc52f4f71be95f59ad98e7d5363272ac28b8bee834892a0126eb07476c9bdbbf66c4019bb7119d
-
SSDEEP
1536:/sMbINXN8/65xycxGm194jmEP8D1km2W07:m19lq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eea811fb924c38ed67895696d1847394_JaffaCakes118
Files
-
eea811fb924c38ed67895696d1847394_JaffaCakes118.sys windows:4 windows x86 arch:x86
7d33d3fd83298c3d8bab41bcfa36b842
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_strnicmp
MmGetSystemRoutineAddress
RtlInitUnicodeString
wcscat
wcscpy
ZwClose
PsCreateSystemThread
RtlCopyUnicodeString
strncmp
IoGetCurrentProcess
PsGetVersion
strncpy
IofCompleteRequest
ExFreePool
ZwEnumerateKey
ExAllocatePoolWithTag
ZwOpenKey
KeDelayExecutionThread
_wcsnicmp
wcslen
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
wcsstr
ZwQueryValueKey
_except_handler3
wcsncmp
towlower
ZwSetValueKey
ZwCreateFile
IoRegisterDriverReinitialization
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ZwQueryInformationFile
ZwDeleteValueKey
Sections
.text Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 224B - Virtual size: 212B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 992B - Virtual size: 982B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ