Static task
static1
General
-
Target
44514cbcababd3c74263cce08c0cdce4_JaffaCakes118
-
Size
27KB
-
MD5
44514cbcababd3c74263cce08c0cdce4
-
SHA1
6c32929ac7702ddac2c131386c0dc18e686f11bf
-
SHA256
c4fce3ff62be1ee8797f70a46175c6c61aecd800e00a9d0fb77e5f2951b9b7c7
-
SHA512
9e9493037550075c4e6011af8383541da2308dea400afd6912062e0e8938af4adfa4b119e2c6a8e8e1cb9783fd3cdfcf51f8fa01ff736ac9041396495cc66e8c
-
SSDEEP
768:wCC8ePYHeDorTTTwFS9sa+hEymZXLS0Vv3gWfxFqmEN:wCC8ePCeDiTTuS7YEnt/gWfxFqmk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 44514cbcababd3c74263cce08c0cdce4_JaffaCakes118
Files
-
44514cbcababd3c74263cce08c0cdce4_JaffaCakes118.sys windows:4 windows x86 arch:x86
f7bb2118227a982485c64032e363cd16
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitUnicodeString
wcslen
swprintf
wcscat
wcscpy
strncmp
ZwClose
ZwOpenKey
ObfDereferenceObject
RtlCopyUnicodeString
ExFreePool
_snprintf
ExAllocatePoolWithTag
_wcsnicmp
strncpy
MmGetSystemRoutineAddress
_strnicmp
_stricmp
RtlAnsiStringToUnicodeString
IofCompleteRequest
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 896B - Virtual size: 870B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ