Static task
static1
General
-
Target
446f838023ddbcbfd546b074a6fb28a5_JaffaCakes118
-
Size
186KB
-
MD5
446f838023ddbcbfd546b074a6fb28a5
-
SHA1
b111cce3efc5952138d5a3dfb4c683f772b1065f
-
SHA256
783a692d223627ccf61af4775b3b4781c9ee7f72a4503f5597be7dd884b41d1f
-
SHA512
62a1fc53e3304ebe7dc7e64ab94d79497dc0a44347d61e7e5bddb0355d53f8977907094157951e291b0e2c8d3f8c96ce77e34e0bdd37f6d33a77dfd5cee66d33
-
SSDEEP
3072:B2XX+LqNXzGamTp8FvbSMa0prc/Rp7C6Tt:KAqFLmTpaaM4mct
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 446f838023ddbcbfd546b074a6fb28a5_JaffaCakes118
Files
-
446f838023ddbcbfd546b074a6fb28a5_JaffaCakes118.sys windows:4 windows x86 arch:x86
a0986d25a38ab330cf168e3c95001820
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitAnsiString
ExFreePool
ZwClose
RtlInitUnicodeString
IofCompleteRequest
ZwOpenKey
ZwCreateKey
memmove
ZwQueryValueKey
RtlAppendUnicodeStringToString
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
ObfDereferenceObject
IoRegisterShutdownNotification
IoUnregisterShutdownNotification
ExAllocatePoolWithTag
RtlIntegerToUnicodeString
IoGetDeviceObjectPointer
KeWaitForSingleObject
IofCallDriver
IoBuildDeviceIoControlRequest
KeInitializeEvent
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 32B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.STL Size: 32B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 896B - Virtual size: 888B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 928B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ