usbscan.pdb
Static task
static1
1 signatures
General
-
Target
1c8451a8cba4483ec237a24f38b4aa53_JaffaCakes118
-
Size
22KB
-
MD5
1c8451a8cba4483ec237a24f38b4aa53
-
SHA1
f3574f52fc1678447b07a6c8393294eecda078b4
-
SHA256
d63a71fecac0c0aef60999ca10926d12ba53d91c9cb8d22ff03132433d78709f
-
SHA512
f6be45928068709656f67ada1eed4976e3382c6274a5cfbc01651aa8b5f79e80b1b58905dd7b02ea2788a3f935d349abee3c3c59c2a5a32d9ad9a0c4f3c963bd
-
SSDEEP
384:8XLkN494jM96l3lVmF6GBEdaHjUBkWSg8WWwWkc7Y3PhQIfPencwOYDEWSg8WWwU:8Xz4jMkZ7mMGqVGWb3PaIf6OWmW
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1c8451a8cba4483ec237a24f38b4aa53_JaffaCakes118
Files
-
1c8451a8cba4483ec237a24f38b4aa53_JaffaCakes118.sys windows:5 windows x86 arch:x86
60d17fce5280c361c3ce2a8a66e30c56
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
RtlFreeUnicodeString
IoCreateSymbolicLink
RtlAnsiStringToUnicodeString
RtlInitAnsiString
_snprintf
RtlUnicodeStringToInteger
wcsstr
ZwQueryValueKey
IoDeleteSymbolicLink
wcslen
KeSetEvent
InterlockedIncrement
InterlockedDecrement
IofCompleteRequest
IoCancelIrp
KeWaitForSingleObject
IofCallDriver
IoBuildDeviceIoControlRequest
KeInitializeEvent
ExFreePool
ExAllocatePoolWithTag
IoOpenDeviceRegistryKey
IoRegisterDeviceInterface
IoDeleteDevice
IoAttachDeviceToDeviceStack
IoCreateDevice
IoDetachDevice
InterlockedExchange
KeCancelTimer
KeReadStateTimer
KeSetTimer
KeInitializeDpc
KeInitializeTimer
MmMapLockedPages
_except_handler3
ProbeForRead
PoCallDriver
PoStartNextPowerIrp
PoRequestPowerIrp
KeTickCount
KeBugCheckEx
RtlInitUnicodeString
ZwSetValueKey
IoSetDeviceInterfaceState
ZwClose
usbd.sys
USBD_ParseConfigurationDescriptorEx
USBD_CreateConfigurationRequestEx
USBD_ParseDescriptors
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 468B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edvm Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 640B - Virtual size: 586B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ