ftdisk.pdb
Static task
static1
1 signatures
General
-
Target
f75b08b6ecb1c2fd67425e0dee3eb90f_JaffaCakes118
-
Size
122KB
-
MD5
f75b08b6ecb1c2fd67425e0dee3eb90f
-
SHA1
eefe719126d7f6b1921406f31f6ba20510718e33
-
SHA256
d56f2e171e2a4552f78f017a0820875427f3d4e35c4934d94d346f58ca42df32
-
SHA512
ac37eef0ac0034288fec545069e79b2be15472364c593636e70b82898f646c0d6fa4218fb4f602374ffcbe60e91ee1631dcb6dfa6b351fcae3d339b42948eae3
-
SSDEEP
3072:dhdvNbNxPAPY23YB/y0sNfVkwT1nvVQA:lRDmY2oB/y0sNphnvV
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f75b08b6ecb1c2fd67425e0dee3eb90f_JaffaCakes118
Files
-
f75b08b6ecb1c2fd67425e0dee3eb90f_JaffaCakes118.sys windows:5 windows x86 arch:x86
3bd9ebbaa28f067d72f14003863c2b19
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ExAllocatePoolWithTag
HalExamineMBR
IoBuildDeviceIoControlRequest
IoGetAttachedDeviceReference
ObfDereferenceObject
KeQuerySystemTime
ExUuidCreate
_allshr
_allmul
memmove
RtlWriteRegistryValue
RtlQueryRegistryValues
RtlCompareMemory
DbgPrint
ObReferenceObjectByHandle
_purecall
RtlCompareUnicodeString
IoGetDeviceObjectPointer
RtlInitUnicodeString
swprintf
IoCreateSymbolicLink
IoDeleteSymbolicLink
IoRegisterDeviceInterface
IoWMIRegistrationControl
IofCompleteRequest
SeReleaseSubjectContext
SeUnlockSubjectContext
SeAccessCheck
IoGetFileObjectGenericMapping
SeLockSubjectContext
SeCaptureSubjectContext
RtlDeleteRegistryValue
RtlCreateRegistryKey
IoFreeWorkItem
IoQueueWorkItem
IoAllocateWorkItem
KeReleaseSemaphore
IoReleaseCancelSpinLock
KeSetEvent
PoCallDriver
PoStartNextPowerIrp
PsTerminateSystemThread
ExQueueWorkItem
IoRegisterShutdownNotification
KeInitializeSemaphore
IoDeleteDevice
IoDetachDevice
IoAttachDeviceToDeviceStack
KeInitializeSpinLock
IoCreateDevice
PoRequestPowerIrp
PoSetPowerState
IoAcquireCancelSpinLock
IoReportTargetDeviceChangeAsynchronous
KeInitializeEvent
KeClearEvent
RtlStringFromGUID
IoSetSystemPartition
ZwClose
ZwFsControlFile
ZwOpenFile
IoInvalidateDeviceRelations
PsCreateSystemThread
RtlEqualUnicodeString
ObfReferenceObject
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
RtlVolumeDeviceToDosName
KeBugCheckEx
IoGetBootDiskInformation
MmLockPagableDataSection
IoInvalidateDeviceState
IoSetDeviceInterfaceState
IoGetDeviceProperty
IoUnregisterShutdownNotification
_alldiv
IoRegisterDriverReinitialization
IoRegisterBootDriverReinitialization
RtlCopyUnicodeString
IoReportDetectedDevice
InterlockedPopEntrySList
InterlockedPushEntrySList
ExInitializeNPagedLookasideList
IoFreeMdl
IoAllocateMdl
MmBuildMdlForNonPagedPool
IoAllocateIrp
FsRtlIsTotalDeviceFailure
IoFreeIrp
IoReuseIrp
IoBuildPartialMdl
MmUnmapLockedPages
_allrem
_alldvrm
_allshl
MmMapLockedPages
IoRaiseInformationalHardError
KeGetCurrentThread
wcslen
ZwQueryValueKey
ZwOpenKey
ZwSetSecurityObject
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
SeExports
_except_handler3
IoBuildSynchronousFsdRequest
IofCallDriver
KeWaitForSingleObject
strncmp
IoReadPartitionTableEx
ExFreePoolWithTag
hal
KfAcquireSpinLock
KfReleaseSpinLock
wmilib.sys
WmiSystemControl
WmiCompleteRequest
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGELK Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ