Static task
static1
General
-
Target
3a5186de8b42555c62682a0e234e4116_JaffaCakes118
-
Size
89KB
-
MD5
3a5186de8b42555c62682a0e234e4116
-
SHA1
747453f1f865b98e1f1513bdc4b63643eed0ea80
-
SHA256
bb98b706f26113c63158a7541b9cccfcd08a81ebe4c66bddd58f57278bdb00b9
-
SHA512
d45a55203eab0967f9d758c1b156d3c57aac86c7bcd26138c89f387762afb9874b93de5d6f5901dc929b85a9f162a7d4b34402e42447d5fab561ca85ccbacae8
-
SSDEEP
1536:pZQtxuDER5iSpBiuUifyhGy2qpuO1XcWUJxvgfLl6DYCpxdbtlJ73kJTz9:p6yDgsSpBiuUZhKqfk5gfUDpLbtld4z9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a5186de8b42555c62682a0e234e4116_JaffaCakes118
Files
-
3a5186de8b42555c62682a0e234e4116_JaffaCakes118.sys windows:5 windows x86 arch:x86
5fe1f900b8969684d9cfce433bbfa0ae
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeInitializeEvent
IoDeleteDevice
KeWaitForSingleObject
ObfReferenceObject
ExFreePoolWithTag
memset
Sections
.text Size: 1024B - Virtual size: 963B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 74KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 256B - Virtual size: 196B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 392B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ