e:\bbb1\obj\i386\moot.pdb
Static task
static1
General
-
Target
08932ec3f7c8a615c59258f23145c745_JaffaCakes118
-
Size
1.4MB
-
MD5
08932ec3f7c8a615c59258f23145c745
-
SHA1
afd95152fde25eee0801c80ae36b40709c514cff
-
SHA256
97e719b699f9f84e14ad967cf6350d19d08d796f8c2892527d1295daa49e8222
-
SHA512
7cb85d5fe80d2936829e3cec7fa8f45d6e37d6873df236fab6de6421c0c6aeff83ee76f05cb9329ce8d888ff2b1eddafd0f93bed625e8af84716d82bf12798e6
-
SSDEEP
24576:Dpo3V3usbxd27dU+Vktv8/lBTlRqVYlNcjwhLO5ZDj:63V3usbDedhe8uUNmaOPj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 08932ec3f7c8a615c59258f23145c745_JaffaCakes118
Files
-
08932ec3f7c8a615c59258f23145c745_JaffaCakes118.sys windows:5 windows x86 arch:x86
9485fa9e22a139393b9916362bcb23bc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
RtlCompareString
RtlInitString
ZwClose
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
DbgPrint
KeServiceDescriptorTable
ZwQueryInformationProcess
ZwDuplicateObject
PsGetCurrentProcessId
RtlInitUnicodeString
KeTickCount
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 142B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 256B - Virtual size: 180B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 384B - Virtual size: 280B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ