f:\work\0047.bho\bho\bho_full_tbws\clever\objfre_wxp_x86\i386\VIDEO.pdb
Static task
static1
1 signatures
General
-
Target
f8e021248d136b32cc80b5768376269a_JaffaCakes118
-
Size
29KB
-
MD5
f8e021248d136b32cc80b5768376269a
-
SHA1
61bf481c096d312e6eb1df28a4909601c0bdcb0b
-
SHA256
03b4dea3cca0339a075bc7ecae8de2e70c488be1e8a4250cad6a147c290a49aa
-
SHA512
9e5480f6a6e0ad9aaf7d6f076db122ea7a48ad202085104659f918e9d5a3d2e630d6403a036951834bb98c8b258b76e809c37ce079ae72f5e2f7af3121c1f88f
-
SSDEEP
384:MQdvOT2A9zDydSqOafSi20ybbtU7ACf5Z6Pk1t1d7/U:MxRsSkfSi7ysAMZ6Ot1dzU
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f8e021248d136b32cc80b5768376269a_JaffaCakes118
Files
-
f8e021248d136b32cc80b5768376269a_JaffaCakes118.sys windows:6 windows x86 arch:x86
4a419c7c41a6941f6fb5d9abc4de2a5d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
_strlwr
strncpy
ObReferenceObjectByHandle
IoGetCurrentProcess
memset
PsLookupProcessByProcessId
wcsncpy
_wcsicmp
memcpy
IoFreeMdl
MmUnmapLockedPages
ZwQueryDirectoryFile
ZwOpenProcess
ZwTerminateProcess
PsGetVersion
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
KeServiceDescriptorTable
ExFreePoolWithTag
ObQueryNameString
ExAllocatePool
KeDelayExecutionThread
ZwClose
ExGetPreviousMode
_stricmp
ZwCreateFile
RtlInitUnicodeString
ExAllocatePoolWithTag
ZwReadFile
ProbeForRead
ZwQuerySystemInformation
ZwCreateKey
swprintf
RtlWriteRegistryValue
RtlCreateRegistryKey
ZwDeleteKey
ZwOpenKey
ZwDeleteValueKey
ZwEnumerateValueKey
ZwQueryKey
wcsstr
_wcslwr
ZwEnumerateKey
CmRegisterCallback
CmUnRegisterCallback
KeQuerySystemTime
PsCreateSystemThread
KeTickCount
KeBugCheckEx
ZwWriteFile
ObfDereferenceObject
RtlUnwind
hal
KeGetCurrentIrql
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ