Static task
static1
General
-
Target
3495d2a29261fcda6b762b5dc47802bf_JaffaCakes118
-
Size
64KB
-
MD5
3495d2a29261fcda6b762b5dc47802bf
-
SHA1
80434c00504ab57244d1463b2bd201d50224170c
-
SHA256
a90ef7ed9c33ced08de4e733d8cafdbf1bd067ce1d1d45068429d1c1591c2389
-
SHA512
33d8dfca2845c74f398d13a9ec283085d571dd3d2886d198cf9525efce2e71773cb19f469d5f261d889a2c25fac5d45c5787793b88c74a4d951a518c0fb928ed
-
SSDEEP
1536:YpJ3uFv5lgo66LExc6Zwcc/ol0q6vU/qA3esjH/A/:YD3s5lgRxicEAmLA3esjH/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3495d2a29261fcda6b762b5dc47802bf_JaffaCakes118
Files
-
3495d2a29261fcda6b762b5dc47802bf_JaffaCakes118.sys windows:4 windows x86 arch:x86
6dfc1f16f855f8475554d45590ce4d8d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IofCallDriver
ExInitializeResourceLite
ExDeleteResourceLite
RtlDecompressBuffer
ZwOpenKey
RtlInitUnicodeString
ZwCreateKey
ZwQueryValueKey
RtlAddAccessAllowedAce
RtlCreateAcl
ExInterlockedAddLargeInteger
RtlLengthSid
SeExports
ObReleaseObjectSecurity
SeSetSecurityDescriptorInfo
ExAllocatePoolWithTag
RtlLengthSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
ObGetObjectSecurity
IoDeleteDevice
ExDeleteNPagedLookasideList
IoQueueWorkItem
ZwNotifyChangeKey
MmPageEntireDriver
IoFreeWorkItem
ExInitializeNPagedLookasideList
IoAllocateWorkItem
IoCreateDevice
DbgBreakPoint
Sections
.text Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.INIT Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ