d:\myproject\img\专用\killprocesse\sys\Demo\i386\CrackmeSys.pdb
Static task
static1
General
-
Target
0dc4c4f46e6bb8a179f44e7dd8cb113f_JaffaCakes118
-
Size
64KB
-
MD5
0dc4c4f46e6bb8a179f44e7dd8cb113f
-
SHA1
cc8dc7bb4e314e0b09da4a548332c9e053fbc088
-
SHA256
eda510d817ad181c27b0361aeb6b278122ce961d0954b0c6876256b8b07d4240
-
SHA512
9a6b50a364502eb5544f56c2d9d49d09de7ff14f8065ec052d96eac4c0e3109a4da87634b88dd0e376edf7534307fa0ba869ec6131b0927fd6e6399539fc3529
-
SSDEEP
1536:sQcM8gacUYM6mmUtWiZMSnNSHLC1xlIJWav:sQcMxXKBZ1nkCnNav
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0dc4c4f46e6bb8a179f44e7dd8cb113f_JaffaCakes118
Files
-
0dc4c4f46e6bb8a179f44e7dd8cb113f_JaffaCakes118.sys windows:5 windows x86 arch:x86
c0d615fff31f3c8a3637baa6f9a75bf4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
ExFreePoolWithTag
_stricmp
DbgPrint
ExAllocatePoolWithTag
ZwQuerySystemInformation
NtBuildNumber
ZwTerminateProcess
MmIsAddressValid
NtOpenProcess
KeGetCurrentThread
ZwClose
ObOpenObjectByPointer
PsLookupProcessByProcessId
ObfDereferenceObject
KeInsertQueueApc
KeInitializeApc
ObReferenceObjectByPointer
PsThreadType
PsLookupThreadByThreadId
_except_handler3
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 896B - Virtual size: 798B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ