Static task
static1
General
-
Target
ffa987fb3cfcf526d5090f053f0a7f81_JaffaCakes118
-
Size
5KB
-
MD5
ffa987fb3cfcf526d5090f053f0a7f81
-
SHA1
247bb3cb907eba35982b1bdf113e35b7bbd53dd2
-
SHA256
33ddc5b1d1009569cc83d45fc2e420c8dd6f99e800f9b1c3e34ccc15e6670a18
-
SHA512
fcd4beecaef8544a588dd115ed37b2106e7ba361115b1777598ff09b615dc2fd5157bf8f83bba5f05c8ee61e481c422717b55472e45dd6fe9251f834a0718675
-
SSDEEP
96:HHhkv2jzK/e2wNkFlio0ona+b0Nwj7h9h1LWRqPiw/g8amZm99T0j:+UInlgIauBL1aRs/g8xZg9Q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ffa987fb3cfcf526d5090f053f0a7f81_JaffaCakes118
Files
-
ffa987fb3cfcf526d5090f053f0a7f81_JaffaCakes118.sys windows:4 windows x86 arch:x86
3261f0ae8982ee0978a3a39860aa2c40
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
InbvAcquireDisplayOwnership
IoCheckEaBufferValidity
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoGetDeviceObjectPointer
IoRegisterDriverReinitialization
IoRegisterFileSystem
IoStopTimer
ObCreateObject
ObDereferenceObject
ObFindHandleForObject
ObReferenceObjectByHandle
ObReferenceObjectByName
ObSetSecurityDescriptorInfo
PfxFindPrefix
PoSetSystemState
PsEstablishWin32Callouts
PsTerminateSystemThread
ZwAccessCheckAndAuditAlarm
ZwClose
ZwOpenDirectoryObject
MmUserProbeAddress
KeServiceDescriptorTable
IoDriverObjectType
DbgPrint
Exfi386InterlockedDecrementLong
Exfi386InterlockedExchangeUlong
Exfi386InterlockedIncrementLong
InterlockedCompareExchange
InterlockedExchangeAdd
InterlockedIncrement
IofCompleteRequest
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 672B - Virtual size: 646B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 192B - Virtual size: 186B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ