Static task
static1
General
-
Target
15e0d37f5c5262269cd6342e0bcc78f4_JaffaCakes118
-
Size
4KB
-
MD5
15e0d37f5c5262269cd6342e0bcc78f4
-
SHA1
3ac7967ed0509e1ff8773dfeb30e74bbe3f69506
-
SHA256
be032034da69f2a9ef233feee08931fff7043f97924a969206f039742cf0d23b
-
SHA512
c41127b5cbd38743557af3d2a00746ab351960747a855ec47c82bbecbd5c2968b3d91b9d8889f927c3c87114643ba715ffa5a57fd1e4cca2ec89e38663a28d9d
-
SSDEEP
48:gJl6J4wrTO/aoWP0ScoVur6FnBKnHDEMkV0KOwMHhavpd4NJUy90FvTggKOqTSR5:o4joc2oVconBARcjBBWNJPOBq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 15e0d37f5c5262269cd6342e0bcc78f4_JaffaCakes118
Files
-
15e0d37f5c5262269cd6342e0bcc78f4_JaffaCakes118.sys windows:5 windows x86 arch:x86
0ee2be84f9c9665f120834a16a0b566c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IofCompleteRequest
strncpy
ObQueryNameString
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
KeDetachProcess
ObfDereferenceObject
ObReferenceObjectByHandle
KeAttachProcess
PsLookupProcessByProcessId
ZwClose
ZwSetInformationProcess
ZwDuplicateToken
ZwOpenProcessToken
ZwOpenProcess
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
KeBugCheckEx
Sections
.text Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 219B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 768B - Virtual size: 676B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 234B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ