e:\gh0st\server\sys\i386\RESSDT.pdb
Static task
static1
General
-
Target
2e02befd7dbc31d2e8abde1525304400_JaffaCakes118
-
Size
2KB
-
MD5
2e02befd7dbc31d2e8abde1525304400
-
SHA1
15348bef35daa9cb915de0007e9f3dca9e6b0eb5
-
SHA256
31aa7f5d7e91ab0f5302ffca2bec68c54583e27f87ddb6ce9726326a3bceab1f
-
SHA512
fe3addfa1ce534c70182ccd662479a27a6f98d850d40881997c7d475da62e7b4d89e63841dacd0bb05a3c791ffc992d7ca5ca230416c5726d48b32f13e4f5e60
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2e02befd7dbc31d2e8abde1525304400_JaffaCakes118
Files
-
2e02befd7dbc31d2e8abde1525304400_JaffaCakes118.sys windows:6 windows x86 arch:x86
b265e194d4216f1e5c56cbf6e3737b32
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
KeTickCount
RtlUnwind
KeBugCheckEx
Sections
.text Size: 896B - Virtual size: 862B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 256B - Virtual size: 180B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 128B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ