Static task
static1
General
-
Target
3bb9fc21149bed1afa4b03573c070268_JaffaCakes118
-
Size
4KB
-
MD5
3bb9fc21149bed1afa4b03573c070268
-
SHA1
d11364f6eb3d0919e98a6cbb8edefec0ede6a110
-
SHA256
3bd6cab9c3412691789a85f4dfe445c6606bbe25e0d9299682ae61da03194421
-
SHA512
f04c5b8fee061ff3737455a45ce9334a44a1c6f5d82895722a5454f475c828fb04ab6d43e2c720aaa92b705eb7862329234b40086acf4d148211d1fac1923864
-
SSDEEP
96:DkIiOStnqL9SOa0ZuDjbfxpXT7fnY3wGs:DkfOSxqxLAD3PD7w3ps
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3bb9fc21149bed1afa4b03573c070268_JaffaCakes118
Files
-
3bb9fc21149bed1afa4b03573c070268_JaffaCakes118.sys windows:5 windows x86 arch:x86
cb68c5d151cba2667ecc7ff4adc4f174
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ObfDereferenceObject
ObOpenObjectByPointer
PsLookupProcessByProcessId
PsTerminateSystemThread
ZwClose
NtBuildNumber
KeClearEvent
KeWaitForSingleObject
_except_handler3
KeCancelTimer
KeSetTimer
KeInitializeTimer
IofCompleteRequest
KeSetEvent
memcpy
ExAllocatePoolWithTag
ObReferenceObjectByHandle
PsCreateSystemThread
KeInitializeEvent
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
strlen
IofCallDriver
IoBuildDeviceIoControlRequest
IoGetDeviceObjectPointer
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 492B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 352B - Virtual size: 344B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 704B - Virtual size: 696B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 320B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ