Static task
static1
General
-
Target
4a03e87cdfc824b845c6fed983d1d762_JaffaCakes118
-
Size
5KB
-
MD5
4a03e87cdfc824b845c6fed983d1d762
-
SHA1
bf34edd00cf8adb53b0d7f537f59dbc70d5aa3ec
-
SHA256
1c3433c68926a1f141b3d9e6b03227a5b1df368ca3b60c71a5a1c083df6e68e8
-
SHA512
d98760f8e133431b2e0b5fe63a78f890c5fb2be7494adb9b833810e4c5ddf03961cf4fefa20322ccd50c818dc39ba1a0bd06fbdd2ce88af49cc4f55d3e550a97
-
SSDEEP
96:JHhkv2jzK/e2wNkFlio0ona+bI4bSwj7h9h1LWRqPiw/g8amZm99T0j:gUInlgIaiBL1aRs/g8xZg9Q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4a03e87cdfc824b845c6fed983d1d762_JaffaCakes118
Files
-
4a03e87cdfc824b845c6fed983d1d762_JaffaCakes118.sys windows:4 windows x86 arch:x86
3261f0ae8982ee0978a3a39860aa2c40
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
InbvAcquireDisplayOwnership
IoCheckEaBufferValidity
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoGetDeviceObjectPointer
IoRegisterDriverReinitialization
IoRegisterFileSystem
IoStopTimer
ObCreateObject
ObDereferenceObject
ObFindHandleForObject
ObReferenceObjectByHandle
ObReferenceObjectByName
ObSetSecurityDescriptorInfo
PfxFindPrefix
PoSetSystemState
PsEstablishWin32Callouts
PsTerminateSystemThread
ZwAccessCheckAndAuditAlarm
ZwClose
ZwOpenDirectoryObject
MmUserProbeAddress
KeServiceDescriptorTable
IoDriverObjectType
DbgPrint
Exfi386InterlockedDecrementLong
Exfi386InterlockedExchangeUlong
Exfi386InterlockedIncrementLong
InterlockedCompareExchange
InterlockedExchangeAdd
InterlockedIncrement
IofCompleteRequest
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 672B - Virtual size: 646B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 192B - Virtual size: 186B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ