e:\实验室\程序\代理\server.11.19_rits\sys\objfre_wnet_x86\i386\sys.pdb
Static task
static1
General
-
Target
28711f34c8dc424bbe862a1e973f7814_JaffaCakes118
-
Size
8KB
-
MD5
28711f34c8dc424bbe862a1e973f7814
-
SHA1
8789ab9f2bd4afb91b99c9cb8e39ae10d7bdaeba
-
SHA256
243fcf1fc00e0aff0531ba58145acb02e6cf6d6efc214e895e3770edc7144577
-
SHA512
c88d07b07ee2ca5cd6bb95f21a9c4a1b866bef2b26673a72c104045bc726507cfd86ed4278b98ffbf44eec9dfe258175bee6403429992b4e752658fc4cd49c8e
-
SSDEEP
192:X/nNFBgpw8F6FV/cHXJ+vqrXLgdJOc0Jg0+Rqb:XeK8wr/cHXJ+vqvaJOhJv+Rq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 28711f34c8dc424bbe862a1e973f7814_JaffaCakes118
Files
-
28711f34c8dc424bbe862a1e973f7814_JaffaCakes118.sys windows:5 windows x86 arch:x86
6bb876bf77816b62c6d2373abdbc6888
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ExFreePoolWithTag
wcscpy
ObQueryNameString
ExAllocatePoolWithTag
wcsncmp
wcslen
wcsstr
_wcslwr
swprintf
DbgPrint
strncmp
IoGetCurrentProcess
ZwDeleteKey
ObfDereferenceObject
ZwSetValueKey
ZwDeviceIoControlFile
ZwQueryDirectoryFile
ZwQuerySystemInformation
KeServiceDescriptorTable
IoDeleteSymbolicLink
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
KeTickCount
KeBugCheckEx
ZwDeleteValueKey
ObReferenceObjectByHandle
hal
KeGetCurrentIrql
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 258B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 358B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ