Static task
static1
General
-
Target
1c0f989f2a1cca5fd518e56bd6525e7d_JaffaCakes118
-
Size
5KB
-
MD5
1c0f989f2a1cca5fd518e56bd6525e7d
-
SHA1
3d177511806902312d79f8ce4ae3f7a3195ce087
-
SHA256
8f039a7cf596ae163e9c8678c9d9053924639c4e32b49070d6fbdeca331197c6
-
SHA512
96711b2316af2bfddea1b16275c85cea34a8cae85d55163f79d7713296b650ae390037346a65a8c6af984f08745db62e2fe8f0a83729b5acb888a2d79d03cfb7
-
SSDEEP
96:WrSfd7awNEmvs3qJKDQjljm8UrlSc9/g8amZiB:gYa7m2qDJy5SW/g8xZiB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1c0f989f2a1cca5fd518e56bd6525e7d_JaffaCakes118
Files
-
1c0f989f2a1cca5fd518e56bd6525e7d_JaffaCakes118.sys windows:4 windows x86 arch:x86
2a316615fee05fb505be6af1fc0fbe84
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
CcCopyRead
ExAllocatePool
ExInitializeZone
InbvAcquireDisplayOwnership
IoAllocateErrorLogEntry
IoCheckEaBufferValidity
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoGetDeviceObjectPointer
IoInitializeIrp
IoRegisterDriverReinitialization
IoRegisterFileSystem
IoStopTimer
ObCreateObject
ObDereferenceObject
ObFindHandleForObject
ObReferenceObjectByHandle
ObReferenceObjectByName
ObSetSecurityDescriptorInfo
PfxFindPrefix
PoSetSystemState
PsEstablishWin32Callouts
PsGetCurrentProcessId
PsLookupProcessByProcessId
PsTerminateSystemThread
SeLockSubjectContext
ZwAccessCheckAndAuditAlarm
ZwClose
ZwOpenDirectoryObject
ZwQueryEaFile
ZwSetValueKey
MmUserProbeAddress
KeServiceDescriptorTable
IoDriverObjectType
DbgPrint
IofCompleteRequest
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 736B - Virtual size: 718B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 192B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ