Static task
static1
General
-
Target
f60f2d932b43b5ff7684c2d28ae0193d_JaffaCakes118
-
Size
12KB
-
MD5
f60f2d932b43b5ff7684c2d28ae0193d
-
SHA1
b0e4defcd577f611173fc570e92e431a23ddd440
-
SHA256
dd1bb8fb86dce78792c1782e00669871e163e6d28f95647dd6397d158bba2471
-
SHA512
7e27d251346939bb3150c95ae9a53e8b41e4ff32d5cd188dbf8e68d3755aeec0e78c800f5c1a7ca090565bcc77f1a12df0a53c14d9da6ec3772b509bb6af327a
-
SSDEEP
192:X8BdjF8czaPIZsasCU6Gi4E4ak1fOnLeUigd3Af1fUp5rVHkVKba88PtBrCtKS3a:X8MIL6Ai5LBAPEKICUS3ZB6X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f60f2d932b43b5ff7684c2d28ae0193d_JaffaCakes118
Files
-
f60f2d932b43b5ff7684c2d28ae0193d_JaffaCakes118.sys windows:5 windows x86 arch:x86
7012fc35bbc20eb530e8d5b4f3464409
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExFreePoolWithTag
RtlAppendUnicodeToString
memcpy
memset
ExAllocatePoolWithTag
_except_handler3
ObQueryNameString
ObfDereferenceObject
ObReferenceObjectByHandle
ProbeForRead
ExGetPreviousMode
toupper
KeReleaseMutex
KeWaitForSingleObject
RtlFreeUnicodeString
RtlCopyUnicodeString
MmIsAddressValid
RtlInitUnicodeString
ZwEnumerateKey
KeServiceDescriptorTable
NtBuildNumber
RtlAppendUnicodeStringToString
ObReferenceObjectByName
IoDriverObjectType
ZwClose
ZwSetInformationProcess
ZwDuplicateToken
ZwOpenProcessToken
ZwOpenProcess
IofCompleteRequest
KeInitializeMutex
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 640B - Virtual size: 516B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 256B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 926B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 768B - Virtual size: 682B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ