X:\drv\dist\win7\usbkbd\win7_release_obj\usbkbd.pdb
Static task
static1
1 signatures
General
-
Target
f229a155af6da43e481d71268eff3106_JaffaCakes118
-
Size
510KB
-
MD5
f229a155af6da43e481d71268eff3106
-
SHA1
dfe3050d2864ec771f594b50b36582fb3529e9a9
-
SHA256
c42259473575e2a5a73fe3e5709b7af0ba7febd77a0bda816336cabc13a9202c
-
SHA512
9f54248cc919a8428ae78a49a1f12110068c8530ef67fda2291a8d946b2bb6f5f12ca83a4693422235a06189dbe51a55f9a77aacd4e40521f068ab0f55267670
-
SSDEEP
6144:eT8+TirXyMInIFHJ3qe81UTBJLx8i8qLQrZoPWNnfgc7KXbdut/7e6jOKCUnOuI6:e+lIIFp3qe4UTrLx82Q2W7KXRc8KHI6
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f229a155af6da43e481d71268eff3106_JaffaCakes118
Files
-
f229a155af6da43e481d71268eff3106_JaffaCakes118.sys windows:6 windows x86 arch:x86
c018222155124e4cb4e5f12e57b53e8a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ZwSetInformationFile
RtlCompareMemory
ZwReadFile
ZwWriteFile
ExAllocatePool
RtlInitUnicodeString
ExSystemTimeToLocalTime
KeQuerySystemTime
RtlAppendUnicodeToString
memcpy
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
KeQueryTimeIncrement
KeTickCount
_allmul
ZwAllocateVirtualMemory
ZwOpenProcess
ZwFreeVirtualMemory
KeDelayExecutionThread
RtlCopyUnicodeString
ObReferenceObjectByHandle
ObfDereferenceObject
PsCreateSystemThread
RtlAppendUnicodeStringToString
RtlIntegerToUnicodeString
ZwNotifyChangeKey
KeCancelTimer
KeSetTimerEx
_wcsicmp
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
memmove
PsLookupProcessByProcessId
RtlTimeToTimeFields
IoFreeMdl
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
IoAllocateMdl
_except_handler3
MmUnmapLockedPages
MmUnsecureVirtualMemory
ObQueryNameString
RtlCompareUnicodeString
RtlFreeUnicodeString
RtlStringFromGUID
ExUuidCreate
strstr
KeWaitForSingleObject
MmUnlockPages
MmProbeAndLockProcessPages
KeSetEvent
KeDetachProcess
KeAttachProcess
KeClearEvent
KeWaitForMultipleObjects
memset
NtAllocateVirtualMemory
KeInitializeEvent
KeInsertQueueApc
KeInitializeApc
PsLookupThreadByThreadId
PsGetCurrentThreadId
IoCreateSynchronizationEvent
KeResetEvent
MmProbeAndLockPages
MmIsAddressValid
ZwQueryInformationFile
KeAddSystemServiceTable
PsGetCurrentProcessId
ExGetPreviousMode
ExfInterlockedInsertTailList
ZwOpenKey
ZwEnumerateKey
ZwQueryValueKey
ZwDeleteKey
ZwSetValueKey
NtAddAtom
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlCompareString
RtlInitString
KeLeaveCriticalRegion
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
IofCompleteRequest
ExfInterlockedInsertHeadList
IoDeleteDevice
IoCreateSymbolicLink
IoRegisterShutdownNotification
IoCreateDevice
wcsncat
IoDetachDevice
IofCallDriver
PoCallDriver
PoStartNextPowerIrp
PsTerminateSystemThread
KeReleaseMutex
KeReadStateEvent
PsSetCreateProcessNotifyRoutine
ExfInterlockedRemoveHeadList
KeSetTimer
ExRegisterCallback
ExCreateCallback
KeInitializeTimerEx
IoCreateNotificationEvent
PsSetLoadImageNotifyRoutine
PsSetCreateThreadNotifyRoutine
ExInitializeResourceLite
InitSafeBootMode
PsGetVersion
ExIsResourceAcquiredExclusiveLite
ExAcquireResourceSharedLite
ExIsResourceAcquiredSharedLite
IoBuildDeviceIoControlRequest
ZwOpenFile
ZwWaitForSingleObject
ZwQueryDirectoryFile
ZwCreateEvent
RtlEqualUnicodeString
qsort
bsearch
ZwFsControlFile
ZwDeviceIoControlFile
ZwQueryVolumeInformationFile
ZwOpenSection
ZwCreateSection
ZwUnmapViewOfSection
ZwMapViewOfSection
IoGetDeviceObjectPointer
KeBugCheckEx
ZwCreateFile
ZwClose
wcsncpy
ExFreePoolWithTag
KeServiceDescriptorTable
ExAllocatePoolWithTag
hal
KfAcquireSpinLock
KfReleaseSpinLock
ExAcquireFastMutex
ExReleaseFastMutex
KeGetCurrentIrql
Sections
.text Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 118KB - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 201KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ