csrss.pdb
Static task
static1
General
-
Target
1647f1b8d216da98b91808c65c6dd95e_JaffaCakes118
-
Size
1.1MB
-
MD5
1647f1b8d216da98b91808c65c6dd95e
-
SHA1
067a07fab114da3fea3d7ddd11838c94d21d2931
-
SHA256
b3b6a4157f6cef885f44317f24d098ff15f26ffcc0dc81b41a0059f9904324d5
-
SHA512
813d68061c16a31d5a78226fcd20234b0668c940058cf5b56c5ea041c078cd25e7ef9c35e710acdacfc826b5df5c168e601d5fcb1732dc47044fc09ed2b6dd78
-
SSDEEP
12288:MZZRzSfw4cYmIjE7KAwSfxL/2Dc3jDLLmt0LDQewsAjRH/HEp64lQaVH8vaZ/MB/:Qmf3s7faewsAjl/HEp6uut96H0r
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1647f1b8d216da98b91808c65c6dd95e_JaffaCakes118
Files
-
1647f1b8d216da98b91808c65c6dd95e_JaffaCakes118.sys windows:5 windows x86 arch:x86
083b2fda79bfff27730cc9cc50f8ecd5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntdll
NtTerminateProcess
NtRaiseHardError
NtTerminateThread
RtlUnwind
NtQueryVirtualMemory
RtlSetProcessIsCritical
NtSetInformationProcess
DbgBreakPoint
RtlAllocateHeap
RtlUnicodeStringToAnsiString
RtlNormalizeProcessParams
csrsrv
CsrServerInitialization
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 108B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ