Static task
static1
General
-
Target
43180197058f30435ed4596af1691825_JaffaCakes118
-
Size
144KB
-
MD5
43180197058f30435ed4596af1691825
-
SHA1
b650a0cb6df130f873c964dd4fe611b0e2a5f629
-
SHA256
63df4b4e212bfd6438e16d536711d9c91e66b92f242d9651dacf02a9f5864d71
-
SHA512
9d4cf4be6f25b46fb6aa4c348b3206af1ce01d7afed4883b181644a48c08afc717b25e5841e2588f7a2d72f001c7bff9acad4d6252f7f15ed6f9773173ea0664
-
SSDEEP
3072:TdWIdk/r2fsTuWdxbwWmKoiA9F5ghsgnR8geqfbzZLloX7:TVI2/axbwWBAHWGgnR8gZDzZLg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 43180197058f30435ed4596af1691825_JaffaCakes118
Files
-
43180197058f30435ed4596af1691825_JaffaCakes118.sys windows:6 windows x86 arch:x86
2621b5e423ebadd412b96f6100f60867
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
KeDelayExecutionThread
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation
hal
KfAcquireSpinLock
HalMakeBeep
fltmgr.sys
FltIsDirectory
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 768B - Virtual size: 708B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 256B - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.abb0 Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.abb1 Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ