Static task
static1
General
-
Target
6387c5a4e6555125a2412c341580b359_JaffaCakes118
-
Size
6KB
-
MD5
6387c5a4e6555125a2412c341580b359
-
SHA1
9d72f77f91c33cb721cea8b25dfb781c27a41f0e
-
SHA256
175bede71341d0b954301c77ebd20dfdb9aac6388c7be06b3e9785208d1e3114
-
SHA512
29ffc81e270ee67ab67a4cee2aaa1fc2a56ed05017130ff9bddf3a3eaf73c43215f5fb8e6835a16f5bbbcb54f42893d815487b9b11643d953409e1820a5e8e58
-
SSDEEP
96:fqg6EIBjI4XCC1jyhoZveTKNXi3tiB8Xa0IEAgiJ:fd6TI4XC0jyhohewoti8LAgiJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6387c5a4e6555125a2412c341580b359_JaffaCakes118
Files
-
6387c5a4e6555125a2412c341580b359_JaffaCakes118.sys windows:5 windows x86 arch:x86
c36c36be183bc0313b1c98e99274ead0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
KeServiceDescriptorTable
IoCreateDevice
ExAllocatePoolWithTag
wcscmp
NtBuildNumber
ZwSetValueKey
ZwOpenKey
_except_handler3
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 640B - Virtual size: 592B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 384B - Virtual size: 338B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 384B - Virtual size: 270B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ