d:\c_inst~1\(最终~1\(最终~1\BIN\i386\Keyboardlogger.pdb
Static task
static1
1 signatures
General
-
Target
f4c9396a31c8e6db3b76f3c0949947ba_JaffaCakes118
-
Size
8KB
-
MD5
f4c9396a31c8e6db3b76f3c0949947ba
-
SHA1
d146d55e7f0d42a280382136b2bfe040ac66c1c5
-
SHA256
7bf014a9ef1449552a6ff773e5d5f1521c9397c4b3a8b95c4430821ef86cda68
-
SHA512
a0fa1f2113f4f27f47542261fbccda9f0bbcdbcc2040686e4e05590d0cb1fd3e6cac7ae4ebb68209e5f6579d59f71c62a2a3df9bd4d1a7982421a594e70b5880
-
SSDEEP
192:63VXawyhseRs9Np6/7Nt0W9XoNRPBEbkdTTBo:mXchsP4cRSbkdx
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f4c9396a31c8e6db3b76f3c0949947ba_JaffaCakes118
Files
-
f4c9396a31c8e6db3b76f3c0949947ba_JaffaCakes118.sys windows:5 windows x86 arch:x86
07d61da7951ed94bfc3cd7de2d308983
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
RtlInitUnicodeString
IoDeleteSymbolicLink
IoDeleteDevice
KeReleaseSemaphore
KeSetTimer
KeWaitForSingleObject
KeInitializeTimer
IoDetachDevice
IoCreateSymbolicLink
KeInitializeSemaphore
KeInitializeSpinLock
RtlInitAnsiString
PsTerminateSystemThread
IoCreateNotificationEvent
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
IoBuildDeviceIoControlRequest
KeInitializeEvent
RtlFreeUnicodeString
IoAttachDevice
RtlAnsiStringToUnicodeString
IoCreateDevice
ExfInterlockedInsertTailList
ExAllocatePoolWithTag
KeTickCount
KeBugCheckEx
KeClearEvent
IofCompleteRequest
ExfInterlockedRemoveHeadList
IofCallDriver
hal
READ_PORT_UCHAR
KeStallExecutionProcessor
WRITE_PORT_UCHAR
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 460B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ