E:\JOB\SourceSafe\Quatoss\VC\StandUSB\SecuDriver\UDSecDrv\Debug_W2K\UDSecDrv2K.pdb
Static task
static1
1 signatures
General
-
Target
250b47d38ecea846bff88fca0fc2419d_JaffaCakes118
-
Size
42KB
-
MD5
250b47d38ecea846bff88fca0fc2419d
-
SHA1
7fd694427de8de110e78eed69d892a6dc237dc51
-
SHA256
59e15ed91510ccd69be49de30a8b1b46b12ff86dc23714e0b728505910a0a5f4
-
SHA512
d3119333f6d2922d5e7f3e673c223349fe7258ed7a8faa45b164401e4d7c46d0793c21d84f1c1a16a56e2dca53a4b91abd64abc57310ab29866d680f3d985095
-
SSDEEP
768:QBBhiQKMnWjt8rLgE4JX0tev3ZU2OgBwaYpm9I/e:SBhNRzUBw7m
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 250b47d38ecea846bff88fca0fc2419d_JaffaCakes118
Files
-
250b47d38ecea846bff88fca0fc2419d_JaffaCakes118.sys windows:5 windows x86 arch:x86
b698862a59d9d8e42501a09aa473fb1f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
RtlFreeAnsiString
_strnicmp
DbgPrint
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitUnicodeString
strstr
_except_handler3
IoGetCurrentProcess
_vsnprintf
RtlUnicodeStringToAnsiString
ZwCreateFile
RtlVolumeDeviceToDosName
ObReferenceObjectByHandle
RtlInitAnsiString
strncmp
KeInitializeEvent
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IofCompleteRequest
ProbeForWrite
KeInitializeSpinLock
KeServiceDescriptorTable
ZwClose
ZwOpenFile
ZwQueryDirectoryFile
ExFreePoolWithTag
ObfDereferenceObject
ExAllocatePoolWithTag
hal
KfReleaseSpinLock
KfAcquireSpinLock
ExAcquireFastMutex
ExReleaseFastMutex
ndis.sys
NdisCancelTimer
Sections
.text Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 964B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 128B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.STL Size: 128B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 976B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ