Static task
static1
General
-
Target
4c228657366f22bbc402143e505c56c2_JaffaCakes118
-
Size
6KB
-
MD5
4c228657366f22bbc402143e505c56c2
-
SHA1
03f421a8e5e62db61614a0aac143785b4f37cd7d
-
SHA256
448294af11e43392b12e04dcd4cd8cbed105d5e778082039d9375fad3a9d034d
-
SHA512
c29302b23e52ca00ac04992e45682fcff9ba680761a1c1082eb385e098e33a8bfd62fae238c1ad2f8c0c139570a86007eb99cc245e8782c3d5db8df2a4a8de5f
-
SSDEEP
96:mt+cXDw87zeTHnWBSQeNCtlz+EE0CfXM+Xy+cmxzvII17lrQP:j6DaTHuSDOlz3ChybcvIIHkP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4c228657366f22bbc402143e505c56c2_JaffaCakes118
Files
-
4c228657366f22bbc402143e505c56c2_JaffaCakes118.sys windows:4 windows x86 arch:x86
9cc6e4d33e731162de7f798903272af1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitAnsiString
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
ObDereferenceObject
MmIsAddressValid
IoGetDeviceObjectPointer
IoDeleteSymbolicLink
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IoCompleteRequest
ExFreePool
ExAllocatePool
DbgPrint
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64B - Virtual size: 60B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 416B - Virtual size: 408B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 112B - Virtual size: 110B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ