Static task
static1
General
-
Target
dc7d7bd47c7ae848bdd58599b3e63e1e_JaffaCakes118
-
Size
2KB
-
MD5
dc7d7bd47c7ae848bdd58599b3e63e1e
-
SHA1
1da8aa94b6b4d58ffd3cb1c4d6337f7728f26e73
-
SHA256
63001616cda090a6cd7e01d756db52d51ae3fd325e325d9199837f73533d05dd
-
SHA512
8799fd9ddb8b1fdea086b1ea4a9b16bae3934f10cf0f63c3ad0a876eed5dc1d74f6d0b22f4de06bf102ce84fb71cf2985c3789d36f0cc80f7cc63918c1aef807
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dc7d7bd47c7ae848bdd58599b3e63e1e_JaffaCakes118
Files
-
dc7d7bd47c7ae848bdd58599b3e63e1e_JaffaCakes118.sys windows:5 windows x86 arch:x86
9ad753cafc956e284ded799938896bf3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeSetEvent
KeDelayExecutionThread
memmove
RtlFreeAnsiString
KeWaitForSingleObject
ObfDereferenceObject
RtlUnicodeStringToAnsiString
ObReferenceObjectByHandle
IofCompleteRequest
MmUnmapIoSpace
MmMapIoSpace
MmGetPhysicalAddress
KeServiceDescriptorTable
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
KeInitializeEvent
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 928B - Virtual size: 909B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 250B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 64B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 576B - Virtual size: 548B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 160B - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ