Static task
static1
General
-
Target
203634869417d66c2168d6aadc4c76d5_JaffaCakes118
-
Size
875KB
-
MD5
203634869417d66c2168d6aadc4c76d5
-
SHA1
61fe8de5053c021baaa62595479f9795858dafdd
-
SHA256
d0c4517c798dae67e6c63f75cd377ba25033afc98876d1fda56896b9e465c30f
-
SHA512
abe8e932f5d920aeb6f7c2006f9fc63fa00507bfc8a5752ce38eec254bd4ea113528c65c8a1bc2fa2ded25ae642ff73794547bd10bd1c77155ad719f6c2232b2
-
SSDEEP
24576:W/0YsukN6Gt6XV9FpZHIoj9vgcQkm1w1WTIRm4lN+TY:ucuw+/p+oF9fIEP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 203634869417d66c2168d6aadc4c76d5_JaffaCakes118
Files
-
203634869417d66c2168d6aadc4c76d5_JaffaCakes118.sys windows:6 windows x86 arch:x86
338c6f5801a2a6dafe2c550f55e67461
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ZwUnmapViewOfSection
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation
hal
KfAcquireSpinLock
HalMakeBeep
Sections
.text Size: 143KB - Virtual size: 143KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 152KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bmm0 Size: 494KB - Virtual size: 494KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bmm1 Size: 66KB - Virtual size: 66KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ