D:\zzz\objfre_w2K_x86\i386\zzz.pdb
Static task
static1
1 signatures
General
-
Target
1b041b89de8730ce73a81ca00bd4396f_JaffaCakes118
-
Size
10KB
-
MD5
1b041b89de8730ce73a81ca00bd4396f
-
SHA1
7a987eec8d58bb26d30ab48b3a81c78f89410cdc
-
SHA256
5b9109d0adf77e886f40f3f28ab12caa4253ec2ad79b886eaca45a88fee98225
-
SHA512
247e6614f1c81ae11e111fe6b8f6f3acb415253bb5a4e13cf9700effc020a32c7d4148eb86cc77cf492175427edc12d20e1ec919e5134fd777fe7d7085d6a940
-
SSDEEP
192:BB9B5J58t3cZIojHwS6H3stf0mbf5SD8Vr6GNNZ7m47YBtjp5kpyvhy00:BB9B5J58eZIo0s+8xSD8Vr/a47mp5kp2
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1b041b89de8730ce73a81ca00bd4396f_JaffaCakes118
Files
-
1b041b89de8730ce73a81ca00bd4396f_JaffaCakes118.sys windows:5 windows x86 arch:x86
2bab89b64be86afecb6e6ba415f1f98e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
KeSetEvent
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
RtlInitUnicodeString
IoGetConfigurationInformation
IoGetDeviceObjectPointer
IoFreeIrp
IoFreeMdl
MmUnlockPages
IofCallDriver
KeGetCurrentThread
MmProbeAndLockPages
ExFreePool
IoAllocateMdl
IoAllocateIrp
KeInitializeEvent
ExAllocatePoolWithTag
_except_handler3
KeWaitForSingleObject
ZwClose
IoDeleteSymbolicLink
IofCompleteRequest
ExfInterlockedInsertTailList
_alldiv
_allshl
_allshr
MmMapLockedPagesSpecifyCache
PsTerminateSystemThread
ExfInterlockedRemoveHeadList
KeSetPriorityThread
ObReferenceObjectByHandle
PsCreateSystemThread
KeInitializeSpinLock
IoCreateSymbolicLink
IoCreateDevice
ZwMakeTemporaryObject
ZwCreateDirectoryObject
ObfDereferenceObject
IoDeleteDevice
hal
KeGetCurrentIrql
KeStallExecutionProcessor
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 388B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 384B - Virtual size: 380B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ