Static task
static1
General
-
Target
fbde2c63a3839bbe802ab57aea4d446d_JaffaCakes118
-
Size
22KB
-
MD5
fbde2c63a3839bbe802ab57aea4d446d
-
SHA1
207201da41a2083097dea6edc4abd4650a09402e
-
SHA256
57f276f5640a21a7346b1a5a11f42489a17c71eb5849e39b3b0438f2eb13581e
-
SHA512
38e46ebad2d7abbbbb9717d3e5b689a4479b985a02cdef09c9b9c3e90efaa96676f0b45ddebb71af394c840513a2b5e4beea0e78326cea9ba570de8692b2a975
-
SSDEEP
384:yMQVXYqexXcZ3DtkOJqcJHkSi3zK/cwVU3GJUhNhLbOfOwrzE:wVIzxspDKtpSkzKkZGJU3hL65zE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fbde2c63a3839bbe802ab57aea4d446d_JaffaCakes118
Files
-
fbde2c63a3839bbe802ab57aea4d446d_JaffaCakes118.sys windows:5 windows x86 arch:x86
86c87dfaa5562f03254badc58764927a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeReleaseMutex
KeWaitForSingleObject
RtlEqualUnicodeString
IoGetDriverObjectExtension
RtlInitUnicodeString
InterlockedExchange
ProbeForWrite
ProbeForRead
strncmp
_except_handler3
IoReleaseCancelSpinLock
InterlockedCompareExchange
_stricmp
_wcsicmp
wcsncpy
wcslen
wcscmp
IoGetDeviceInterfaces
ExFreePool
IofCompleteRequest
IoDeleteSymbolicLink
KeInitializeMutex
KeInitializeSpinLock
IoCreateSymbolicLink
IoCreateDevice
ZwClose
ZwQueryValueKey
ZwOpenKey
RtlAppendUnicodeToString
ZwEnumerateKey
KeInitializeEvent
ExAllocatePoolWithTag
IoDeleteDevice
hal
KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 288B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 96B - Virtual size: 72B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 928B - Virtual size: 926B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aape Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 896B - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 480B - Virtual size: 452B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ