c:\ati\windrv\44\44\windows\sys\amd64\ahcix64s.pdb
Static task
static1
General
-
Target
2b488c84030f7fe71563793aba9db07f_JaffaCakes118
-
Size
204KB
-
MD5
2b488c84030f7fe71563793aba9db07f
-
SHA1
cb160ab0035c333c0de04fb135eb55bb004104fa
-
SHA256
72a2ae423d8c804cbaba16510b11fc00268ae98ff9b89f2839d9fd0043b3028d
-
SHA512
6fc5808ff1553510a9cd066cd07b01b5a3947d52780e06b1eb94931ffc9c0546f401386ce1b71dd8a152b41c5e2a572097ef3bbfef74750d04e1df8eeb9e07ef
-
SSDEEP
3072:VSAUf3rqk6gcMgBd0ub2icPtsjl32XKpaa:VvUf3ek6zB32i2Sjl3haa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2b488c84030f7fe71563793aba9db07f_JaffaCakes118
Files
-
2b488c84030f7fe71563793aba9db07f_JaffaCakes118.sys windows:6 windows x64 arch:x64
c37c7a0f5e551fc1c6e74d0fdf3b9c33
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
ntoskrnl.exe
ExSystemTimeToLocalTime
KeBugCheckEx
DbgPrint
RtlAppendUnicodeToString
RtlQueryRegistryValues
KeQueryTimeIncrement
storport.sys
StorPortStallExecution
StorPortGetPhysicalAddress
StorPortNotification
StorPortDeviceReady
StorPortResumeDevice
StorPortBusy
StorPortResume
StorPortReady
StorPortDeviceBusy
StorPortGetBusData
StorPortGetScatterGatherList
StorPortPauseDevice
StorPortGetDeviceBase
StorPortLogError
StorPortPause
StorPortInitialize
StorPortValidateRange
StorPortGetUncachedExtension
ScsiPortNotification
Sections
.text Size: 130KB - Virtual size: 130KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 1024B - Virtual size: 972B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
��oc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ