Static task
static1
General
-
Target
073bb663afbd194087d1079a73adb7ec_JaffaCakes118
-
Size
91KB
-
MD5
073bb663afbd194087d1079a73adb7ec
-
SHA1
c7d9cfbd3b8cfecf2b18a3ab8b2d55ad22a0db1c
-
SHA256
61193e00a4c5ec61566a4c853b6b50b195d84bd160219493701d822b2b112218
-
SHA512
60cea108f839c47bd83346eb55f0d74b5a6edffe6528351ba5c9b35217ecb69f9530654ba07b6475eb79e10a7b08ebe49be817716aff7ae8c5ba355b8ad362bc
-
SSDEEP
1536:+SRMh/Ofl7XqHoxLCA4d3scl+xXWMne3O6Ow0O4yse/:+YftXqH6Wxpscl+xXWMxHwb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 073bb663afbd194087d1079a73adb7ec_JaffaCakes118
Files
-
073bb663afbd194087d1079a73adb7ec_JaffaCakes118.sys windows:5 windows x86 arch:x86
21ea3d2ddce3672fcda210c7c31f192c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoAllocateWorkItem
IofCallDriver
KeSetEvent
KeInitializeMutex
ExAllocatePoolWithTag
ObfDereferenceObject
IoDeleteDevice
ExFreePoolWithTag
IoFreeIrp
ZwClose
KeInitializeDpc
ObfReferenceObject
IoAttachDevice
IoFreeWorkItem
KeInitializeEvent
KeWaitForSingleObject
memset
IoAllocateMdl
hal
ExReleaseFastMutex
ExAcquireFastMutex
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 640B - Virtual size: 540B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ