D:\cvshome\absrc\garden\pc\FwDrv\Driver\objfre_wxp_x86\i386\GFltDrv.pdb
Static task
static1
General
-
Target
f0f5ce7859a3df186ce81fb1c882975f_JaffaCakes118
-
Size
2KB
-
MD5
f0f5ce7859a3df186ce81fb1c882975f
-
SHA1
9b4572a490520450f981f81635c76306b168d992
-
SHA256
c6e9f687c13e08096b09272295300d64a94f06a0b4f6864eb484ddd26fa56b7b
-
SHA512
f918ae2807149876bd6d36b8fee5d1d3ac9a083e2e28f52aa457b66aae7bd861624a2224273c8bda90fbce3b3f8bdcde9be1d59ac9cac27cc66e9c058036c801
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f0f5ce7859a3df186ce81fb1c882975f_JaffaCakes118
Files
-
f0f5ce7859a3df186ce81fb1c882975f_JaffaCakes118.sys windows:5 windows x86 arch:x86
ad68c41ab7fb2811e35dbe6c750777ad
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
IoBuildDeviceIoControlRequest
KeInitializeEvent
IoGetDeviceObjectPointer
RtlInitUnicodeString
ExAllocatePoolWithTag
ExFreePoolWithTag
IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 512B - Virtual size: 432B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 128B - Virtual size: 118B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ