d:\vc\mdtgdm\objchk_wxp_x86\i386\MDTGDM.pdb
Static task
static1
General
-
Target
2237ba15856213982a6c4f6e0b524fe6_JaffaCakes118
-
Size
5KB
-
MD5
2237ba15856213982a6c4f6e0b524fe6
-
SHA1
439a7322dfb4c19dad331519e76be8c9f017d0f8
-
SHA256
ed143969681075b516a0c41576ae2a06fa9080d6dbc3692e6370dd930055343b
-
SHA512
07c9e25cab1023c623488d6a6248dd5d976b3135b78207cd1ea8cc65120fcb2222a6739be7afb9b4769428f2f20b314f50eb7fd53b1bc5e5d5d07eee5b96ba22
-
SSDEEP
48:Qvs/2mH3Fwp3Facvn1g5Muyp3VMYGtLzIVgVusb0mxW27jB7nJnlvHyojjR+VOCv:nFwBFL/1ywMYGtP2g1AmRBjfKof2Tj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2237ba15856213982a6c4f6e0b524fe6_JaffaCakes118
Files
-
2237ba15856213982a6c4f6e0b524fe6_JaffaCakes118.sys windows:5 windows x86 arch:x86
73e9f4480ae935e926f23f5972648d3e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IofCompleteRequest
DbgPrint
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IoCreateSymbolicLink
IoCreateDevice
KeServiceDescriptorTable
KeTickCount
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 896B - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 384B - Virtual size: 354B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 202B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ