Static task
static1
General
-
Target
2f01f954e39381b9dbb1d2ec7d1c4bff_JaffaCakes118
-
Size
13KB
-
MD5
2f01f954e39381b9dbb1d2ec7d1c4bff
-
SHA1
534d2f20973ce0c5d3d827d95cff1e8cdf011f03
-
SHA256
4aa30c153307b4c740353dc510b59f865be3693e9608a0309dc5eadfc8be725d
-
SHA512
efada3c1b75cdee15b7163871a22adf080e607a005148acb622002a74458fbffb613373a595ad5223ca1279cf997d5be1f806844883ed38b927df008b15015c7
-
SSDEEP
384:r/oGiM0YhOSOYw/oGiM0JtP0j3sXnNCihfP:LqEhOqG3onNCUfP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2f01f954e39381b9dbb1d2ec7d1c4bff_JaffaCakes118
Files
-
2f01f954e39381b9dbb1d2ec7d1c4bff_JaffaCakes118.sys windows:5 windows x86 arch:x86
b47f4c52413087691d7125276a3756c7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoFreeMdl
KeTickCount
KeQueryTimeIncrement
KeDelayExecutionThread
MmProbeAndLockPages
IoAllocateMdl
IofCompleteRequest
PsCreateSystemThread
ExAllocatePoolWithTag
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ExFreePoolWithTag
_strnicmp
IoGetCurrentProcess
KeInsertQueueApc
KeInitializeApc
KeUnstackDetachProcess
MmMapLockedPagesSpecifyCache
KeStackAttachProcess
sprintf
ZwCreateFile
ZwReadFile
ZwWriteFile
ZwQueryInformationFile
ZwClose
_except_handler3
Sections
PAGE Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 768B - Virtual size: 700B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 384B - Virtual size: 328B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ