Static task
static1
General
-
Target
a0a714b11548268a52837c7cf699306a_JaffaCakes118
-
Size
41KB
-
MD5
a0a714b11548268a52837c7cf699306a
-
SHA1
2c70be25595190b1a940c0300b51a1eca6e8c954
-
SHA256
08025144d625765a59da590addb2164c923de188b7519ef2ca464ba16a358282
-
SHA512
05e83166a62f3b2e0e945fd79a18b8fb021f34d4c0447bb594ab7c663c23a579d654373ee39c29a8b6bf3fd107d3897fa8756e418707db8e7f757e8371040d99
-
SSDEEP
768:MY1gFDct8fANfM5eCWK2pWmV7E4Ge2J0yFPuvePU557t4yOams1m2bL:B1gFQVCe42pWkDGeWFPuvsa7mTs1m2H
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a0a714b11548268a52837c7cf699306a_JaffaCakes118
Files
-
a0a714b11548268a52837c7cf699306a_JaffaCakes118.sys windows:5 windows x86 arch:x86
b19b91337ed7bd22b8b813e9052d6eb3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
SeReleaseSubjectContext
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ExAllocatePoolWithTag
PsGetCurrentThread
KeBugCheck
MmIsNonPagedSystemAddressValid
MmGetSystemRoutineAddress
RtlUpcaseUnicodeString
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 128B - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 384B - Virtual size: 356B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 128B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ