Static task
static1
General
-
Target
ce14901c7a7fd385d1f5c4562d18992d_JaffaCakes118
-
Size
79KB
-
MD5
ce14901c7a7fd385d1f5c4562d18992d
-
SHA1
a3517201369162e9c15b4ea4b6ae24e614f80db7
-
SHA256
10422edb3eccbffcd3e3aba77b3761a1334d2e0605174bb90c0933d7a89044fe
-
SHA512
af1acf34d45da7d6a4d3f96a49b5e9eec733728d4f79cb16b5da7d64ecc5bcd5b527ca10b40c366503a71fbe041567117926ca5aabba1f2ae6c0c1c68c7373fa
-
SSDEEP
1536:OBGWSfliA1CS64X2OcC0MuPkSGkYvtKBYo7rchX8og:OBqz1Cnc2jqSGtqYo7rgX8og
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ce14901c7a7fd385d1f5c4562d18992d_JaffaCakes118
Files
-
ce14901c7a7fd385d1f5c4562d18992d_JaffaCakes118.sys windows:5 windows x86 arch:x86
e6e36d291d4c326115e0c4ddced6b863
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitUnicodeString
RtlCompareUnicodeString
IoCreateDevice
IoDetachDevice
IoCancelIrp
IoAllocateWorkItem
IoAttachDeviceToDeviceStack
IoGetAttachedDeviceReference
IoDeleteDevice
IofCompleteRequest
IoReleaseCancelSpinLock
IoQueueWorkItem
IoSetDeviceInterfaceState
IofCallDriver
IoBuildSynchronousFsdRequest
IoInvalidateDeviceState
IoWMIRegistrationControl
ExAllocatePoolWithTag
ExFreePoolWithTag
Sections
.text Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 640B - Virtual size: 576B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 410B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ