d:\sdgdsgdf.pdb
Static task
static1
1 signatures
General
-
Target
ede88117bd354143f83a6422389b10d0_JaffaCakes118
-
Size
17KB
-
MD5
ede88117bd354143f83a6422389b10d0
-
SHA1
b60a50535e683f08185f8c29b058b27161c18e46
-
SHA256
725401f897d7d3cdd78ad0846ee27e36b0a7388e7bea78a7a11f1049051c6a34
-
SHA512
417a01274a0352f10e03f0ede21a4f7c3e25de4363b2c32bb62b4729cb2e44cd9aa02e5605d669f09246b52d4483df6a65ea21ba12e2f0e8f763c3f3501ac238
-
SSDEEP
384:blKwuk7RJcgQZB28PcddkNSPqUmFw73aURpqQ8AO1fo4+abs33w42Q:f9K5cfPCSZX3+Q
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ede88117bd354143f83a6422389b10d0_JaffaCakes118
Files
-
ede88117bd354143f83a6422389b10d0_JaffaCakes118.sys windows:5 windows x86 arch:x86
13e292d9d00ae61b3210e1dc270366e6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
wcsncmp
wcslen
ExFreePoolWithTag
ZwEnumerateKey
ExAllocatePoolWithTag
sprintf
_strupr
wcscpy
wcscmp
RtlFreeAnsiString
RtlCompareMemory
RtlUpperString
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
PsGetCurrentProcessId
ZwQueryDirectoryFile
ZwQueryValueKey
ZwEnumerateValueKey
ZwOpenKey
ZwDeviceIoControlFile
ZwQuerySystemInformation
IoDeleteDevice
IoDeleteSymbolicLink
wcscat
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
IofCompleteRequest
KeServiceDescriptorTable
IoCreateSymbolicLink
IoCreateDevice
_wcsupr
ZwClose
ZwSetValueKey
swprintf
ObfDereferenceObject
RtlInitAnsiString
ObReferenceObjectByHandle
strchr
ObQueryNameString
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 952B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 128B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 896B - Virtual size: 780B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ