H:\FU_Rootkit\exe\i386\msdirectx.pdb
Static task
static1
General
-
Target
f79438ad145a795385cf48c03658e73e_JaffaCakes118
-
Size
661KB
-
MD5
f79438ad145a795385cf48c03658e73e
-
SHA1
5ce1a53d0dfe7d951d1e1300aa1478d0fd2d7e70
-
SHA256
93e4713162c199fbf26809b0d410039c87477625f4f7a945991a14f73600a8a9
-
SHA512
3066549f62d3eb770b39fd3a2d4c555ae91b8287b229bbdc2cdb17d1c3b28d8670dddf6c98dbc2cfad6d96b9d33e11c96591ffc354d74a48c7e5df9f0e7611a4
-
SSDEEP
192:Ml09KS2nrm5FBH0bq8c5HnIb/JPPNFKcRbbELuPxZNhdZfRWwHFRloBw:g09+ixUb52HI9lFKcRboiPDndZ4Bw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f79438ad145a795385cf48c03658e73e_JaffaCakes118
Files
-
f79438ad145a795385cf48c03658e73e_JaffaCakes118.sys windows:5 windows x86 arch:x86
a48e0d88d6398030eeb8d151f500e1ce
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
strncmp
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IoGetCurrentProcess
RtlFreeUnicodeString
RtlCompareUnicodeString
RtlAnsiStringToUnicodeString
_snprintf
PsGetCurrentProcessId
DbgPrint
ExFreePoolWithTag
ExAllocatePoolWithTag
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 249B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 524B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 230B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ