Static task
static1
General
-
Target
729972c3105ae5e8754c9ba0a11e5f03_JaffaCakes118
-
Size
2KB
-
MD5
729972c3105ae5e8754c9ba0a11e5f03
-
SHA1
8f92d91461660837bfa646fd7469e77f35bf9197
-
SHA256
a6d6caead401932af495814e6dc97a2cb361231c5b72218da1986ca9806f84b8
-
SHA512
db74dd3fb753ddc8d757a5bcd63119cd33a0a4eba42327932d9bb9028f78a684b41a79b57b9a4917755b8f7ee9a9ec00a833b6fe0ff85770b7e2712bb61bc02d
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 729972c3105ae5e8754c9ba0a11e5f03_JaffaCakes118
Files
-
729972c3105ae5e8754c9ba0a11e5f03_JaffaCakes118.sys windows:5 windows x86 arch:x86
91183d22c7d9bdc5b65ec026c20cd4a0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeSetEvent
KeDelayExecutionThread
memmove
KeWaitForSingleObject
RtlFreeAnsiString
_stricmp
ObfDereferenceObject
RtlUnicodeStringToAnsiString
ObReferenceObjectByHandle
IofCompleteRequest
MmUnmapIoSpace
MmMapIoSpace
MmGetPhysicalAddress
KeServiceDescriptorTable
KeInitializeEvent
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
IoDeleteDevice
IoDeleteSymbolicLink
Sections
.text Size: 896B - Virtual size: 892B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 288B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 64B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 576B - Virtual size: 564B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 160B - Virtual size: 154B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ