Static task
static1
General
-
Target
ce4934259a83186f19f799805798b5f8_JaffaCakes118
-
Size
5KB
-
MD5
ce4934259a83186f19f799805798b5f8
-
SHA1
d46f6b1295495c5b73a2743e5d11868aed968a3d
-
SHA256
349b513d3994e70b37d6b4749954fde93822638605ac63ea00e57a845f775125
-
SHA512
b899e719f138440aae8741c24fd5e46cc7296f8aa74f9fd052e8be41c41af0ef3c298391c96217bb7114479ead6a2771ad9a8c7445e26e2ebd35eec3e6bc02f4
-
SSDEEP
96:EQe2spapA9pcec75PA34jdrx1U70YHxmSsDpp+vTlk4Z9:EQPqvIX1mZRudp0Tlrz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ce4934259a83186f19f799805798b5f8_JaffaCakes118
Files
-
ce4934259a83186f19f799805798b5f8_JaffaCakes118.sys windows:4 windows x86 arch:x86
e585e9ef33bb6f70c1546d9a6d615668
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExAllocatePoolWithTag
ExFreePoolWithTag
PsSetLoadImageNotifyRoutine
ObMakeTemporaryObject
KeInitializeApc
KeInsertQueueApc
FsRtlIsNameInExpression
RtlImageDirectoryEntryToData
ExAllocatePool
ZwQueryDirectoryFile
KeGetCurrentThread
PsRemoveLoadImageNotifyRoutine
RtlWriteRegistryValue
KeServiceDescriptorTable
ObfReferenceObject
RtlCreateRegistryKey
ZwEnumerateKey
ZwAllocateVirtualMemory
memcpy
memset
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ