Static task
static1
General
-
Target
a8d9048db88c0b60a64cf6d893e2164e_JaffaCakes118
-
Size
5KB
-
MD5
a8d9048db88c0b60a64cf6d893e2164e
-
SHA1
d822461a40e629e07d3f89dcbbda54773fc94b4a
-
SHA256
eacf9608add3e1003354b545aad566d6d96d31238d500d64812ef3f10ab04244
-
SHA512
ece5177932e80bdbb6b93a74a08bc7f1afb6d0023ac3be4477e6b3d2c809ed338f22fe20c5840860a77f516434c223d2419871520634dbd3baaf6f9de95a1f4b
-
SSDEEP
96:YcPA3qTRw0Q9KR8KyN0tPjJFhE5hQPh45SL:Yco3qT+01hp4u
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a8d9048db88c0b60a64cf6d893e2164e_JaffaCakes118
Files
-
a8d9048db88c0b60a64cf6d893e2164e_JaffaCakes118.sys windows:5 windows x86 arch:x86
96ff9104893f30ef4a5cb4c740001a7f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
InterlockedIncrement
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
SeCreateAccessState
IoGetFileObjectGenericMapping
KeInitializeEvent
IoAllocateIrp
ObCreateObject
ObfDereferenceObject
NtClose
ObReferenceObjectByHandle
IoFileObjectType
IoCreateFile
RtlInitUnicodeString
InterlockedDecrement
IoReuseIrp
KeClearEvent
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoDeleteDevice
KeSetEvent
ExFreePoolWithTag
KeServiceDescriptorTable
RtlFreeUnicodeString
wcscat
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwClose
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
ExFreePool
ExAllocatePoolWithTag
NtQuerySystemInformation
IoCreateDevice
IoFreeMdl
IoFreeIrp
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 286B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 5B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 968B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 384B - Virtual size: 318B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ