Static task
static1
General
-
Target
2722febb9abc218194301ff15bf1425e_JaffaCakes118
-
Size
15KB
-
MD5
2722febb9abc218194301ff15bf1425e
-
SHA1
9cca8634b37ee5f04ccdb64b46d6e7bd95808453
-
SHA256
aa91086a7ec692704f84de1007721f16fb59933c557632dba7a3bb9220b0c4cc
-
SHA512
5182424b61e50587a5fcfa10384aa5ca306ac819b2fa4e1955c896b02e5e4f40c4f158390ecb97068b6efe9aff7c723cea906be41c008c75c3696b43ef83bffd
-
SSDEEP
384:RhNyEw8NdFwCInGWqmOcFdA9EG24HiZaBjQvEQUgyedl/Fyh7PqteX1N9B1+8OJR:RLws+1R
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2722febb9abc218194301ff15bf1425e_JaffaCakes118
Files
-
2722febb9abc218194301ff15bf1425e_JaffaCakes118.sys windows:5 windows x86 arch:x86
89ead1f827cf8ab05b92f50e29d53536
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
ExFreePool
PsTerminateSystemThread
RtlFreeAnsiString
_stricmp
_strlwr
RtlUnicodeStringToAnsiString
ExAllocatePoolWithTag
ZwQuerySystemInformation
ExGetPreviousMode
MmIsAddressValid
ProbeForWrite
ProbeForRead
_except_handler3
IofCompleteRequest
PsGetCurrentProcessId
_strupr
IoGetCurrentProcess
strrchr
KeUnstackDetachProcess
ZwTerminateProcess
KeStackAttachProcess
PsLookupProcessByProcessId
PsSetLoadImageNotifyRoutine
ZwPulseEvent
MmGetSystemRoutineAddress
IoCreateSymbolicLink
IoCreateDevice
ZwQueryInformationProcess
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
MmSizeOfMdl
strncmp
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
zdata Size: 288B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
vdata Size: 288B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 960B - Virtual size: 946B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 384B - Virtual size: 360B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ