Static task
static1
General
-
Target
5bcdc3e0425d41df36339a889274fab7_JaffaCakes118
-
Size
41KB
-
MD5
5bcdc3e0425d41df36339a889274fab7
-
SHA1
74ec8a8b0981bed9a8f84495e3a2d22334db13bd
-
SHA256
c2fedb59e3d5de5b414ad1245762f2f137f88481dcb931ead78d5f269f7d7f4d
-
SHA512
897e95747a46a531c485ee342428a5ef793bfd8f8a928eda84a60e59288099e2765cb99fb31edad620f97154456268dd37055ea25573b435576cd889cfff1736
-
SSDEEP
768:ESRxnKF1omThoHbwkbPuLkhwwGtDP2UJGL9qrrGhDQ:ESLnKvvKHbwkb2LkMP2m4uah8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5bcdc3e0425d41df36339a889274fab7_JaffaCakes118
Files
-
5bcdc3e0425d41df36339a889274fab7_JaffaCakes118.sys windows:5 windows x86 arch:x86
66c7271e49517f7893301518780e33b0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExAllocatePoolWithTag
ExUuidCreate
SeAssignSecurity
NtQueryVolumeInformationFile
RtlInitUnicodeString
RtlAddAccessAllowedAceEx
RtlStringFromGUID
MmGetSystemRoutineAddress
MmIsNonPagedSystemAddressValid
Sections
.text Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 128B - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 384B - Virtual size: 350B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 128B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ