usb8023.pdb
Static task
static1
1 signatures
General
-
Target
0e8f446cf9bd0c45816e29aaf7596413_JaffaCakes118
-
Size
22KB
-
MD5
0e8f446cf9bd0c45816e29aaf7596413
-
SHA1
9711b4e3dea89024420ee7cc487756ef5f1320d5
-
SHA256
c244303f72b7417331115f8bbca2cbe97435b0920ba808df220d37a74a8ea8ae
-
SHA512
5cc9cf895d7101372fd59fcc545a047aa9ce3233b56506fc5e2da91d644c657b4e72a4419a766c6d1ee16293edc29950279954d247c37eaee162d49724e262ba
-
SSDEEP
384:1N79OoV324U9IBNA+hzDtYZkMCj2Sm9KNBybx43F8WJ8McwWLj0WIbbbIOGQigwT:1bDG3qc+RDqZlCj2P9Ks2AMoj0WIbbb+
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e8f446cf9bd0c45816e29aaf7596413_JaffaCakes118
Files
-
0e8f446cf9bd0c45816e29aaf7596413_JaffaCakes118.sys windows:5 windows x86 arch:x86
4ad8aaa48ca68839d1cfb3447c7c2246
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
InterlockedDecrement
InterlockedIncrement
ExFreePool
IoFreeMdl
IoAllocateMdl
IoCancelIrp
memmove
ExAllocatePoolWithTag
KeSetEvent
IoAllocateIrp
MmBuildMdlForNonPagedPool
MmMapLockedPages
KeTickCount
KeInitializeEvent
KeInitializeTimer
KeInitializeDpc
KeSetTimer
IoQueueWorkItem
IoAllocateWorkItem
IofCallDriver
KeWaitForSingleObject
IoFreeIrp
IoFreeWorkItem
KeInitializeSpinLock
hal
KfRaiseIrql
KfAcquireSpinLock
KeGetCurrentIrql
KfReleaseSpinLock
KfLowerIrql
usbd.sys
USBD_CreateConfigurationRequestEx
USBD_ParseConfigurationDescriptor
rndismp.sys
RndisMInitializeWrapper
RndisMSendComplete
RndisMIndicateReceive
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edld Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 448B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ