c:\winddk\0001\objchk_wxp_x86\i386\0001.pdb
Static task
static1
General
-
Target
f1d3ef0b8fdf73a618fa440f6c8c3eda_JaffaCakes118
-
Size
3KB
-
MD5
f1d3ef0b8fdf73a618fa440f6c8c3eda
-
SHA1
a803fd5d7ea2cd2ebd9902de2b593b306187a918
-
SHA256
24c6c7addf35990d2c8741c7b83f6b6a966041cc5d121d01f9a8adc11ab0437d
-
SHA512
5e4ba9b0f97aca0dd2028eb58d7d9b4acad9f64fa5ba7f547fc892fa1be6f095474da0f2dac1b780fc3860f5a528a6d0cb951f49a0dfb8fd1d32c406bfbc11ee
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f1d3ef0b8fdf73a618fa440f6c8c3eda_JaffaCakes118
Files
-
f1d3ef0b8fdf73a618fa440f6c8c3eda_JaffaCakes118.sys windows:6 windows x86 arch:x86
1fc15a727bb9ad76b3dee2f4380ece29
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IofCompleteRequest
PsLookupProcessByProcessId
PsLookupThreadByThreadId
MmMapLockedPagesSpecifyCache
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
Sections
.text Size: 896B - Virtual size: 858B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 512B - Virtual size: 400B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 128B - Virtual size: 78B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ