Static task
static1
General
-
Target
412be3fb8801d558495107a5f37fc0ad_JaffaCakes118
-
Size
18KB
-
MD5
412be3fb8801d558495107a5f37fc0ad
-
SHA1
ee6953e40ff78dd9d3caa653dfb9fcef3838faa7
-
SHA256
c5c7fdd537bf13ac63311078021591a9cd62c13d54b52c4ddfe9e0a66141f6e3
-
SHA512
a32d23a4e28557ff392865b99919bd76091f091726a25a622abe06c06f1f0089795da20bdd0036eaf081bf108c551b469d867583247c4572486de2487df610b9
-
SSDEEP
48:61FNHuFwyfqJrTl5+BjNlWcYRwgouUo75ym/iuDOl/aiVw5:4jOWyfqVx5AutfxVR/iuDO5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 412be3fb8801d558495107a5f37fc0ad_JaffaCakes118
Files
-
412be3fb8801d558495107a5f37fc0ad_JaffaCakes118.sys windows:5 windows x86 arch:x86
d79236bb83424e3d264c84a6896016f9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoGetCurrentProcess
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwClose
ZwReadFile
RtlFreeUnicodeString
ZwCreateFile
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 928B - Virtual size: 918B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 96B - Virtual size: 69B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 224B - Virtual size: 224B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 64B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ