Static task
static1
General
-
Target
a28467c5f5b8e7f6b4b288471d2a60cf_JaffaCakes118
-
Size
5KB
-
MD5
a28467c5f5b8e7f6b4b288471d2a60cf
-
SHA1
4a9a42fa0e6e59ca49caa8cdcdfb902d3a17fe9d
-
SHA256
0ee2ba2a2d9dc3aafbcb53d1edd4465ca3ae242f5a40bc2634b9bae16f9e7750
-
SHA512
b5668eae47131f5e9c233c0e8d11c97f92b90bb93e8a3692fc53bbfb285eda3735766631382386867627b9885298e5429192e61e8b68c8436435ac9c01f5fa77
-
SSDEEP
96:cQL83jkxqDWsFMc0SlbuAEAayouDOhsRB7g0nvYPh45S1:NIEqDv6c0S5FG/H4S
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a28467c5f5b8e7f6b4b288471d2a60cf_JaffaCakes118
Files
-
a28467c5f5b8e7f6b4b288471d2a60cf_JaffaCakes118.sys windows:5 windows x86 arch:x86
1dbdd74b5796256ed46a913b889ea4d7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IoFreeIrp
IoFreeMdl
KeSetEvent
InterlockedIncrement
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
SeCreateAccessState
IoGetFileObjectGenericMapping
KeInitializeEvent
IoAllocateIrp
ObCreateObject
ObfDereferenceObject
NtClose
ObReferenceObjectByHandle
IoFileObjectType
IoCreateFile
RtlInitUnicodeString
InterlockedDecrement
IoReuseIrp
KeClearEvent
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoDeleteDevice
ExFreePoolWithTag
KeServiceDescriptorTable
RtlFreeUnicodeString
wcscat
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwClose
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
ExFreePool
ExAllocatePoolWithTag
NtQuerySystemInformation
IoCreateDevice
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 271B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 5B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 960B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 384B - Virtual size: 262B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ