Static task
static1
General
-
Target
d032ada17a46dd4fcc46d9c876c500f8_JaffaCakes118
-
Size
7KB
-
MD5
d032ada17a46dd4fcc46d9c876c500f8
-
SHA1
a4f8266142983a7eab7db0e68e699b4e33621330
-
SHA256
f99c277de1f02f32eeb54b0f1d1a2895f5ddf7f2e589b62d5eda6c3552aaab60
-
SHA512
fa6028b3828ea17760d294d30b70593aed9a2f143fa392151010f1bc68ffa0267a875f842226707e124a43ed93736b6cbf1152da8bfcbf7390f2c5b2ed1206b4
-
SSDEEP
96:RRg5pW/2oKXKDLzmdfiXLruUFUESKQoBV2Sj:R2vS2zXKXzMaXLK6r2a
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d032ada17a46dd4fcc46d9c876c500f8_JaffaCakes118
Files
-
d032ada17a46dd4fcc46d9c876c500f8_JaffaCakes118.sys windows:5 windows x86 arch:x86
1340ce7f1580a77ac5397e62aac4305f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_wcsnicmp
MmIsAddressValid
ObReferenceObjectByName
IoDriverObjectType
IoDeleteDevice
IoAttachDeviceToDeviceStack
RtlInitUnicodeString
wcslen
ObfDereferenceObject
IoGetDeviceObjectPointer
IofCallDriver
InterlockedIncrement
InterlockedDecrement
IofCompleteRequest
KeInitializeSpinLock
IoCreateSymbolicLink
IoCreateDevice
hal
KfAcquireSpinLock
KfReleaseSpinLock
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 576B - Virtual size: 572B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 192B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ