Static task
static1
General
-
Target
45d41455ea62b3527bd4d33b467d16c9_JaffaCakes118
-
Size
24KB
-
MD5
45d41455ea62b3527bd4d33b467d16c9
-
SHA1
a9e3041173b2781c44edea8614823f3a7c6c0ba2
-
SHA256
63e883c055d712ddb9e6792766a1fe39c193a6c46ed68d3378351fc311063632
-
SHA512
7a7d5aa32b011882720c642b6b80c48d57145122ddb77d583dfb23a7db070fd1cfe6ddef2f50b5f97383f891bcfdd1bfab70ed0cced8fd516317cf30d6f1c039
-
SSDEEP
384:2AfxV0LbrYOxRcWE4sjvMkm3OJ8RlbRXoRWtZ2cLkg/:2AfxV0k7obRXoRq2lK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 45d41455ea62b3527bd4d33b467d16c9_JaffaCakes118
Files
-
45d41455ea62b3527bd4d33b467d16c9_JaffaCakes118.sys windows:5 windows x86 arch:x86
ab80384896acdb57bd551513855e2088
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ObfDereferenceObject
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
IoFreeIrp
KeSetEvent
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
IoAllocateIrp
KeInitializeEvent
ExFreePool
ExAllocatePoolWithTag
strncpy
IoGetCurrentProcess
IoDeleteDevice
IoDetachDevice
strncmp
IoQueryVolumeInformation
ZwClose
RtlFreeAnsiString
IoAttachDeviceByPointer
IoCreateDevice
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
ZwCreateFile
MmMapLockedPagesSpecifyCache
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
KeServiceDescriptorTable
ObQueryNameString
InterlockedExchange
ZwEnumerateKey
IofCompleteRequest
IoCreateSymbolicLink
NtBuildNumber
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 353B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 940B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 888B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 540B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ