Static task
static1
General
-
Target
4288107f4cae233b3f0a503d4fe79631_JaffaCakes118
-
Size
5KB
-
MD5
4288107f4cae233b3f0a503d4fe79631
-
SHA1
d695fc2780c8344f5564ee1fe1fb9cba2d9cd6ae
-
SHA256
9d54c9e300469a924467601e076b52d29cc5bfb4b3cc0acb9787cb0a8a46180b
-
SHA512
1114a2431d4e6a50ac23614e5572c3c869cc756a6a4020d737d7acbbeff1c4ccf0a552dd39f06e6d59ad2e32ff68a3fc4b37df75d283403e9de0c59be66ea7ea
-
SSDEEP
96:ZLKsA27+6E4F9mK9TzhOBOSRax/S97bZbV5jaiSyyAYRHMZO28:sKPF9mKhttSox/eaiByXj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4288107f4cae233b3f0a503d4fe79631_JaffaCakes118
Files
-
4288107f4cae233b3f0a503d4fe79631_JaffaCakes118.sys windows:4 windows x86 arch:x86
1e6e644c81877aec4addaaffe44dc62f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExInitializeNPagedLookasideList
IoAttachDeviceToDeviceStack
IoCallDriver
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoDetachDevice
IoGetAttachedDeviceReference
IoGetDeviceObjectPointer
KeInitializeMutex
KeInitializeSpinLock
KeReleaseMutex
ExFreePool
KeWaitForMutexObject
ObDereferenceObject
ObReferenceObjectByHandle
PoCallDriver
PoStartNextPowerIrp
ExEventObjectType
DbgPrint
ExInterlockedPopEntrySList
ExInterlockedPushEntrySList
IofCompleteRequest
KefReleaseSpinLockFromDpcLevel
ObfDereferenceObject
ExDeleteNPagedLookasideList
KeSetEvent
ExAllocatePool
hal
KfAcquireSpinLock
KfReleaseSpinLock
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 704B - Virtual size: 686B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 96B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 320B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ