D:\zzz\objfre_w2K_x86\i386\zzz.pdb
Static task
static1
1 signatures
General
-
Target
f46f27acc196c9a3f9768aeb9ca6ab04_JaffaCakes118
-
Size
10KB
-
MD5
f46f27acc196c9a3f9768aeb9ca6ab04
-
SHA1
d50a64d1bc69754158a158a1cb1c58a4880bf97d
-
SHA256
83401f9214e918d32419b935058bb72177f0d9bd33ad36c2e0bd7b34c244c773
-
SHA512
4ba76d8597153b72740337a46f5fc2f683ce8c2b02dc958a93e2ad7bb9b3f5acdfcde3ca749d75a97c6fbaa7b17abd4dc0deb8f1c5d9dcba0cfe606f48a67645
-
SSDEEP
192:oV5J5ZEFa7ZGRjiPAi3/cf01bf5EO8i9iaNNZKvw/NXtvhy:oV5J5ZEoZGRW/j1xEO8i9icKvwttU
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f46f27acc196c9a3f9768aeb9ca6ab04_JaffaCakes118
Files
-
f46f27acc196c9a3f9768aeb9ca6ab04_JaffaCakes118.sys windows:5 windows x86 arch:x86
753c2070d6a4ff84728e749869bc28f8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
KeSetEvent
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
RtlInitUnicodeString
IoGetConfigurationInformation
RtlCompareUnicodeString
IoGetDeviceObjectPointer
IoFreeIrp
IoFreeMdl
MmUnlockPages
IofCallDriver
KeGetCurrentThread
MmProbeAndLockPages
ExFreePool
IoAllocateMdl
IoAllocateIrp
KeInitializeEvent
ExAllocatePoolWithTag
_except_handler3
KeWaitForSingleObject
ZwClose
IoDeleteSymbolicLink
IofCompleteRequest
ExfInterlockedInsertTailList
_alldiv
_allshl
_allshr
MmMapLockedPagesSpecifyCache
PsTerminateSystemThread
ExfInterlockedRemoveHeadList
KeSetPriorityThread
ObReferenceObjectByHandle
PsCreateSystemThread
KeInitializeSpinLock
IoCreateSymbolicLink
IoCreateDevice
ZwMakeTemporaryObject
ZwCreateDirectoryObject
ObfDereferenceObject
IoDeleteDevice
hal
KeGetCurrentIrql
KeStallExecutionProcessor
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 388B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 390B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ