Static task
static1
General
-
Target
fd4753732f6ba1e990d5d350f3422ee9_JaffaCakes118
-
Size
15KB
-
MD5
fd4753732f6ba1e990d5d350f3422ee9
-
SHA1
7cd84f6c1de5d63ef9013dadb47bbaa85f5c1e90
-
SHA256
08b5568cadf09e183601e09994b20369da2e582ecc1e3fa972f7c732537661c1
-
SHA512
97c8d20e7de6a24de2cade225451e2689dece1e2b6bce4a69b6dcb53921bab08c76d742bc3a3272ea7de805a52623fb87e634daf31059665d5d77a3c4559206b
-
SSDEEP
192:o92+9sUQlsTU2eycDcoepi8hWaeOHAKYijGf8COZRSXN7faNunlltR3ke:22+GoCNevJnHH1COElfaNunlltRUe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fd4753732f6ba1e990d5d350f3422ee9_JaffaCakes118
Files
-
fd4753732f6ba1e990d5d350f3422ee9_JaffaCakes118.sys windows:5 windows x86 arch:x86
b3d7176032cc7d764c4ef684bcc16d69
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeUnstackDetachProcess
ZwTerminateProcess
KeStackAttachProcess
PsLookupProcessByProcessId
ExGetPreviousMode
MmIsAddressValid
ProbeForWrite
ProbeForRead
_except_handler3
strncmp
IoGetCurrentProcess
IofCompleteRequest
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
ExAllocatePoolWithTag
MmSizeOfMdl
ZwQueryInformationProcess
PsGetCurrentProcessId
_stricmp
_strupr
RtlFreeAnsiString
_strlwr
strrchr
RtlUnicodeStringToAnsiString
ExFreePool
ZwPulseEvent
MmGetSystemRoutineAddress
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ZwQuerySystemInformation
IoDeleteDevice
IoDeleteSymbolicLink
PsTerminateSystemThread
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 352B - Virtual size: 328B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 928B - Virtual size: 912B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 384B - Virtual size: 358B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ