C:\StarBurnInstall\StarBurn\Bin\Dynamic\Release\i386\StarOpen.pdb
Static task
static1
General
-
Target
306521935042fc0a6988d528643619b3_JaffaCakes118
-
Size
5KB
-
MD5
306521935042fc0a6988d528643619b3
-
SHA1
3388fd72afc73c408a5d5ffbd31fca4c402a0589
-
SHA256
6fcc06ea71f5c83a8c3a8b7152e9ff48bcfbd35ed8c134a0879735f9135bb20c
-
SHA512
8fa8996d20c92311c9bc3310238f301b5f225f5ce82a8a9d8013b8bc7918dc287eeabe67134ba290c73dfbd64e749db1fd34c6f4e1a4b1432fc3c1fcf022149b
-
SSDEEP
96:vVv8puAADuGo9ujh63tXoGoK4t717ENexloBDiI2uDEXtPdFWCo:2AA4A9oGwZANGloBDiyeVF5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 306521935042fc0a6988d528643619b3_JaffaCakes118
Files
-
306521935042fc0a6988d528643619b3_JaffaCakes118.sys windows:5 windows x86 arch:x86
c43cc97b0f2b888df242a92dc371e006
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
_vsnprintf
KeBugCheck
IofCompleteRequest
_except_handler3
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
RtlFreeUnicodeString
ZwClose
ExFreePoolWithTag
ZwDuplicateObject
ZwOpenFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ExAllocatePoolWithTag
RtlQueryRegistryValues
IoCreateSymbolicLink
IoCreateDevice
DbgPrint
KeTickCount
Sections
.text Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 580B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ