Static task
static1
General
-
Target
a805e639e37ecb7ba908d8398f229053_JaffaCakes118
-
Size
23KB
-
MD5
a805e639e37ecb7ba908d8398f229053
-
SHA1
fcb2e4bd992a25216d856ff891f6f4a7fce68116
-
SHA256
d76355875139c8b25d70a1ec085f66750a25331f46f2f0c7536311841d24fbb1
-
SHA512
15d145316c3605fee9c64f3f4285bb37bf4c67222306662b9eb93aaf32f466fc0794d8732d342824e313751c9ff9a469d28a47454e36bf7c7bb9229b963cfac1
-
SSDEEP
384:XJ3zY+fbIH56oEE5THCerUz14Ro6fck1lOCawOBW:X5zY2+GaTHVQhgoi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a805e639e37ecb7ba908d8398f229053_JaffaCakes118
Files
-
a805e639e37ecb7ba908d8398f229053_JaffaCakes118.sys windows:4 windows x86 arch:x86
07c5f948fb7eaaddb0733cd479f233ec
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_strnicmp
wcslen
swprintf
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
ObfDereferenceObject
strncmp
RtlCopyUnicodeString
strncpy
ExFreePool
_snprintf
ExAllocatePoolWithTag
_wcsnicmp
MmIsAddressValid
RtlCompareUnicodeString
ExGetPreviousMode
_stricmp
MmGetSystemRoutineAddress
IofCompleteRequest
wcscpy
_except_handler3
Sections
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 864B - Virtual size: 840B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 1014B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ