Static task
static1
General
-
Target
a7342cd208472445225a1033c81c2c28_JaffaCakes118
-
Size
8KB
-
MD5
a7342cd208472445225a1033c81c2c28
-
SHA1
a787c878759494aa2c5ef31516478450f49074bf
-
SHA256
28c7e636d74c8c4b2b086a053c0f8a6362ac4c80f61508aabd9d66a4b473fe7a
-
SHA512
7740be449bb7413ff00abeda1b7ba33928e5f589b54ca8217cc97eb8d7a86cc4a4e4919d28480cf02302884e63306f44b46fc009cd74d5486ff3fe3e11417b53
-
SSDEEP
96:ilAEOkDxCEKwF4Xl8BkCWe8QpLutifBOcGqBklFQlYG5AAkFl9+KT81oY:iyEOpHTQkCW6fBOsBk8YG5AA6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a7342cd208472445225a1033c81c2c28_JaffaCakes118
Files
-
a7342cd208472445225a1033c81c2c28_JaffaCakes118.sys windows:4 windows x86 arch:x86
428f5d7953ca6d97b47d47d2cfd212be
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoFreeMdl
MmUnlockPages
MmGetSystemRoutineAddress
_stricmp
strrchr
ObfDereferenceObject
IoDriverObjectType
IoCreateFile
ZwClose
ZwQueryInformationFile
KeWaitForSingleObject
KeSetEvent
MmProbeAndLockPages
IoAllocateMdl
IoAllocateIrp
KeInitializeEvent
IoGetCurrentProcess
ObReferenceObjectByHandle
IoFileObjectType
_allmul
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeGetCurrentThread
wcslen
hal
KeStallExecutionProcessor
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 736B - Virtual size: 732B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 704B - Virtual size: 686B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 320B - Virtual size: 290B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ