Static task
static1
General
-
Target
1b3d520d75b6a5fa8d06762960f04045_JaffaCakes118
-
Size
32KB
-
MD5
1b3d520d75b6a5fa8d06762960f04045
-
SHA1
fdcfa863e75c333a7efdefd3c2da18edd9f1f57e
-
SHA256
76495a8f34d16f7aa12a2e930964760ba4522961a02092bbd471e71ac3eab969
-
SHA512
aea781e5463f429767c0696663589bc32938eef95517aa799ea423b38f790c3890acfe92bf6ebcdef7572216721610b70bfba383bcbb86fb3262943e9a3d8e01
-
SSDEEP
768:PUn7RljXsnne4TwMDCQXL0RNetF0Yx1AnSYLQkkkal:87RljD4PCQXILez0YbAnSYXkkal
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1b3d520d75b6a5fa8d06762960f04045_JaffaCakes118
Files
-
1b3d520d75b6a5fa8d06762960f04045_JaffaCakes118.sys windows:4 windows x86 arch:x86
0b39e67487195885b32c89e97c48eab0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeInitializeTimer
KeInitializeDpc
InterlockedExchange
KeCancelTimer
KeRemoveQueueDpc
MmBuildMdlForNonPagedPool
IoBuildDeviceIoControlRequest
IoAllocateMdl
PsGetCurrentProcessId
IoReleaseCancelSpinLock
KeSetTimer
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IoDeleteSymbolicLink
IofCompleteRequest
IoDetachDevice
RtlAppendUnicodeToString
swprintf
ExAllocatePoolWithTag
ExFreePoolWithTag
_aullrem
ObReferenceObjectByHandle
IoFreeIrp
IoAllocateIrp
MmMapLockedPagesSpecifyCache
IoAttachDeviceToDeviceStack
IoGetDeviceObjectPointer
RtlInitUnicodeString
RtlCompareMemory
IofCallDriver
IoFreeMdl
memset
ObfDereferenceObject
memcpy
hal
KfAcquireSpinLock
KfReleaseSpinLock
tdi.sys
TdiMapUserRequest
Sections
.text Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 388B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 49B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ