Static task
static1
General
-
Target
3084407de521612aa4d35b27e7a47dbd_JaffaCakes118
-
Size
9KB
-
MD5
3084407de521612aa4d35b27e7a47dbd
-
SHA1
156cd84b2ae2e5cf580fafdb5a47608dfec4dc62
-
SHA256
815e924ab22bc7d397cd573a9c823f43eb18cb3a5f5bb2e348e96e5ff23d5136
-
SHA512
2e2565dbbbb9c5211d38c1f50ed07ea146986fe4113ad008e59423b5136b745e6ceafbf43e30c17717354a11c92bd7f923350b1d4f902f4ea6dc5fd8da73ee7c
-
SSDEEP
96:3i//wn7/n+muGIQmd1DGnxYsR/yeDWJ++rYrDsAQO3cKZQ69SBLuMxT3flQanqrA:3GIhTtmHD66K/ywFM+YVKZQ69KLtxIrA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3084407de521612aa4d35b27e7a47dbd_JaffaCakes118
Files
-
3084407de521612aa4d35b27e7a47dbd_JaffaCakes118.sys windows:5 windows x86 arch:x86
c75a80f7e81a09b4b377363788c42fff
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExFreePool
wcsstr
_wcsnicmp
wcslen
_local_unwind2
KeSetEvent
KeClearEvent
strstr
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
IoBuildDeviceIoControlRequest
KeInitializeEvent
IoGetDeviceObjectPointer
_except_handler3
ZwQueryDirectoryFile
ZwQuerySystemInformation
KeServiceDescriptorTable
ZwDeviceIoControlFile
IoDeleteDevice
IoDeleteSymbolicLink
ZwClose
IofCompleteRequest
KeResetEvent
strncpy
IoCreateNotificationEvent
KeInitializeSpinLock
IoCreateSymbolicLink
IoCreateDevice
ExAllocatePoolWithTag
RtlInitUnicodeString
wcsncpy
hal
KfReleaseSpinLock
KfAcquireSpinLock
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 352B - Virtual size: 332B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 896B - Virtual size: 890B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 484B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ