c:\winddk\demo\_darkshell\i386\DarkShell.pdb
Static task
static1
General
-
Target
173b26a528b80d939a770e999621aa82_JaffaCakes118
-
Size
14KB
-
MD5
173b26a528b80d939a770e999621aa82
-
SHA1
1826623aa3c0a713ea9d46dccd1bffa7edb1a072
-
SHA256
9ec4bfa121f78bb61fcf55d59054b399cf9e84c8a12dcdc18d060cd4c2c2920e
-
SHA512
19066b89aa45ce21cf5b10ade821fc7a3a514bde1181fef870622e830f0082b58cf5705de4f9223f942d314a483fd79691e970a1824cb3071ac68c68073558a3
-
SSDEEP
96:H9LESLfn0oxc1/8pG6y4F+pqX6CA5D+RV5w/QpLOgp9PTJcadj0oLMMGY4rs:1jrFO0BjFxeaRV5wIpLOgzPT6QEhY0s
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 173b26a528b80d939a770e999621aa82_JaffaCakes118
Files
-
173b26a528b80d939a770e999621aa82_JaffaCakes118.sys windows:6 windows x86 arch:x86
07ab1cbed45ec57fff7df0ac91b4a085
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
MmGetSystemRoutineAddress
RtlInitUnicodeString
IofCompleteRequest
DbgPrint
KeServiceDescriptorTable
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateDevice
memmove
memcpy
KeTickCount
RtlUnwind
KeBugCheckEx
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 512B - Virtual size: 414B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ