Static task
static1
General
-
Target
ea57b8e47695e38a09abd7fb92ec745f_JaffaCakes118
-
Size
8KB
-
MD5
ea57b8e47695e38a09abd7fb92ec745f
-
SHA1
39b016a809ba4fd39faf085b637fe5b723b59fed
-
SHA256
1db696b3dacfd0f442d70564538be38e2dfdd7df54d2378bb03e6611dd4ea3ba
-
SHA512
3ca7945dd0b94dc96ec8319e73c358d5fc43955b60858ee0685610a23f47d1b81e86c8862e61abdac5ac7f0575c136111b09ba3ff6efe199d69735e13612bc77
-
SSDEEP
192:GkGFvZ62Jk4k5iDkwIe9Jr1/8D46eXctsP901:zKi4Bw3o6eLV01
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ea57b8e47695e38a09abd7fb92ec745f_JaffaCakes118
Files
-
ea57b8e47695e38a09abd7fb92ec745f_JaffaCakes118.sys windows:5 windows x86 arch:x86
a8a6270c1e266c1a6460369418b343d2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_stricmp
IoGetCurrentProcess
ZwClose
ZwUnmapViewOfSection
strncmp
PsGetVersion
strncpy
DbgPrint
ObfDereferenceObject
KeDetachProcess
KeAttachProcess
PsLookupProcessByProcessId
_except_handler3
ZwMapViewOfSection
ZwCreateSection
ZwQuerySystemInformation
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
RtlFreeAnsiString
RtlCompareMemory
RtlUnicodeStringToAnsiString
IoCreateSymbolicLink
IoCreateDevice
IofCompleteRequest
wcscmp
ZwEnumerateKey
ZwDeviceIoControlFile
ZwQueryDirectoryFile
ZwCreateKey
ZwSetValueKey
wcslen
ExAllocatePoolWithTag
strncat
ZwOpenFile
ExFreePool
hal
KfRaiseIrql
KfLowerIrql
KeGetCurrentIrql
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 320B - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 192B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 576B - Virtual size: 564B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ