c:\mozy_build\windows_progs\bdsfilter\objfre_wlh_x86\i386\bds.pdb
Static task
static1
1 signatures
General
-
Target
0837c2b5ef1b0fe496d08e1b267f96dd_JaffaCakes118
-
Size
46KB
-
MD5
0837c2b5ef1b0fe496d08e1b267f96dd
-
SHA1
f77b546ff429dba74852138e7b6b4e95d18abaff
-
SHA256
b557fea9ca7ccc8ac8f983447da9002bbd32a4eb3b9cea52b3695589b631f12f
-
SHA512
492c342516c2488964c28963c3930ae3790b9635d9d24c715544cf176e1e84684b23e68df3af2659d20317eba5f1554b045808957cb9b7fa4c06d6e90982d782
-
SSDEEP
768:SIUNHUE0Oos/2/feo5AvEIrXXWBZt40JgS2srpnj:SIUN0EMs/2/fDd/hJPpj
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0837c2b5ef1b0fe496d08e1b267f96dd_JaffaCakes118
Files
-
0837c2b5ef1b0fe496d08e1b267f96dd_JaffaCakes118.sys windows:6 windows x86 arch:x86
ed9b899f3737f953ab92cf89074c19a5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
KeWaitForSingleObject
KeClearEvent
ZwClose
ExFreePoolWithTag
RtlCopyUnicodeString
ExAllocatePool
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
IoCreateDevice
ExAllocatePoolWithTag
IofCallDriver
KeGetCurrentThread
ObReferenceObjectByHandle
IoFileObjectType
IoAllocateIrp
RtlAppendUnicodeStringToString
ZwCreateFile
RtlAppendUnicodeToString
RtlCompareUnicodeString
swprintf
IoGetTopLevelIrp
memcpy
PsCreateSystemThread
IoUnregisterFsRegistrationChange
IoDeleteSymbolicLink
IoCreateSymbolicLink
KeSetEvent
InitSafeBootMode
DbgBreakPoint
memset
wcschr
ZwReadFile
ZwOpenFile
ZwSetValueKey
ExInterlockedPopEntrySList
ExInterlockedPushEntrySList
sprintf
KeQuerySystemTime
IofCompleteRequest
ExQueueWorkItem
wcsncpy
ObQueryNameString
IoBuildSynchronousFsdRequest
_snwprintf
ObReferenceObjectByPointer
IoGetRelatedDeviceObject
ZwQueryInformationFile
_wcsnicmp
MmGetSystemRoutineAddress
PsGetVersion
IoAttachDeviceToDeviceStack
KeTickCount
KeBugCheckEx
RtlUnwind
IoFreeIrp
IoDetachDevice
IoDeleteDevice
ObfDereferenceObject
ObfReferenceObject
DbgPrint
ExInitializeNPagedLookasideList
KeInitializeEvent
hal
KfRaiseIrql
KfLowerIrql
KfAcquireSpinLock
KfReleaseSpinLock
ExAcquireFastMutex
ExReleaseFastMutex
KeGetCurrentIrql
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 848B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ