Static task
static1
General
-
Target
bf1bd2010ab02e86818c985596305d39_JaffaCakes118
-
Size
5KB
-
MD5
bf1bd2010ab02e86818c985596305d39
-
SHA1
a9d0123c124bfa20ca09e006e32c669a0f607a99
-
SHA256
f3cba15f04b0a04d8ff43ccd224e606d6f85ce08abb2030c80409adc686deeba
-
SHA512
e559b07edc834fe9d532e96ad157575a140f8b8403d22c461c70a3841a1ee82e35f50561b4c612dfa1828382fe884fbc962e90aa53832d6ab0b7fc4aee1a56d7
-
SSDEEP
96:RoHhkv2jzK/e2wNkFlio0ona+b5AO3oleffBy7gQa64Piw/g8amZm99T0j:NUInlgIacfBy7gQW/g8xZg9Q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bf1bd2010ab02e86818c985596305d39_JaffaCakes118
Files
-
bf1bd2010ab02e86818c985596305d39_JaffaCakes118.sys windows:4 windows x86 arch:x86
3261f0ae8982ee0978a3a39860aa2c40
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
InbvAcquireDisplayOwnership
IoCheckEaBufferValidity
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoGetDeviceObjectPointer
IoRegisterDriverReinitialization
IoRegisterFileSystem
IoStopTimer
ObCreateObject
ObDereferenceObject
ObFindHandleForObject
ObReferenceObjectByHandle
ObReferenceObjectByName
ObSetSecurityDescriptorInfo
PfxFindPrefix
PoSetSystemState
PsEstablishWin32Callouts
PsTerminateSystemThread
ZwAccessCheckAndAuditAlarm
ZwClose
ZwOpenDirectoryObject
MmUserProbeAddress
KeServiceDescriptorTable
IoDriverObjectType
DbgPrint
Exfi386InterlockedDecrementLong
Exfi386InterlockedExchangeUlong
Exfi386InterlockedIncrementLong
InterlockedCompareExchange
InterlockedExchangeAdd
InterlockedIncrement
IofCompleteRequest
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 672B - Virtual size: 646B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 192B - Virtual size: 186B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ