AVABBBBVVVVVAVBVBBABBBBAAAAAAAAAAA
Static task
static1
General
-
Target
895c972ed916ae9c60026c6fa384f6be_JaffaCakes118
-
Size
3KB
-
MD5
895c972ed916ae9c60026c6fa384f6be
-
SHA1
93338973fc7fdc9d6c5282183c730e8fc2879239
-
SHA256
7bdb84a1af3756995591bd80d173c29d9ca07dcd6a723d1c38747102163a6d24
-
SHA512
d75c91d0fb3eef5e1ee0f0b726b9ad733e6038572e544c58ec8ea96520406c8240cd472fe7dbd1e24874c33bc1a9cdd2a1d9ecf19d563303150dbd13ae4bad31
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 895c972ed916ae9c60026c6fa384f6be_JaffaCakes118
Files
-
895c972ed916ae9c60026c6fa384f6be_JaffaCakes118.sys windows:5 windows x86 arch:x86
85917607166cfe282aba9ee9b399dd93
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IoFreeIrp
KeSetEvent
KeWaitForSingleObject
IofCallDriver
RtlAssert
KeGetCurrentThread
KeInitializeEvent
ObfDereferenceObject
IoAllocateIrp
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
IoFileObjectType
RtlInitUnicodeString
ZwSetValueKey
wcslen
ZwOpenKey
IoCreateSymbolicLink
DbgPrint
IoCreateDevice
IofCompleteRequest
MmUnmapViewOfSection
PsLookupProcessByProcessId
IoDeleteDevice
IoDeleteSymbolicLink
ZwClose
IoCreateFile
hal
KeGetCurrentIrql
Sections
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 768B - Virtual size: 714B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 166B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ