Static task
static1
General
-
Target
e9f1cb29d75b98b70ea48651ae0e97ad_JaffaCakes118
-
Size
12KB
-
MD5
e9f1cb29d75b98b70ea48651ae0e97ad
-
SHA1
b29c7dc5b1b80c6d660e951a9a08d8cea14dcde7
-
SHA256
34a8195b9df9819832e267460772806499d0da5f11f5dc5f07c6510df50eb046
-
SHA512
d7c9ca1b482e919a72ef860225d9f254533aa320243a045610b72c81c6e3fbaae2706b8859f1c26c82f2e2fb605e89879382c3bd6c18eac872fecda359089547
-
SSDEEP
192:XpBdjF8czaPIZsasCU6Gi4E4ak1fOnLeUigd3Af1fUp5rVHkVKba88PtBrCtKS3e:XpMIL6Ai5LBAPEKICUS3Z96X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e9f1cb29d75b98b70ea48651ae0e97ad_JaffaCakes118
Files
-
e9f1cb29d75b98b70ea48651ae0e97ad_JaffaCakes118.sys windows:5 windows x86 arch:x86
7012fc35bbc20eb530e8d5b4f3464409
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExFreePoolWithTag
RtlAppendUnicodeToString
memcpy
memset
ExAllocatePoolWithTag
_except_handler3
ObQueryNameString
ObfDereferenceObject
ObReferenceObjectByHandle
ProbeForRead
ExGetPreviousMode
toupper
KeReleaseMutex
KeWaitForSingleObject
RtlFreeUnicodeString
RtlCopyUnicodeString
MmIsAddressValid
RtlInitUnicodeString
ZwEnumerateKey
KeServiceDescriptorTable
NtBuildNumber
RtlAppendUnicodeStringToString
ObReferenceObjectByName
IoDriverObjectType
ZwClose
ZwSetInformationProcess
ZwDuplicateToken
ZwOpenProcessToken
ZwOpenProcess
IofCompleteRequest
KeInitializeMutex
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 640B - Virtual size: 516B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 256B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 926B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 768B - Virtual size: 682B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ