G:\炉子\VC++_Program\KPDrv\objchk\i386\KPDrv.pdb
Static task
static1
General
-
Target
2bd3837425a96880afb0a05770a5499b_JaffaCakes118
-
Size
4KB
-
MD5
2bd3837425a96880afb0a05770a5499b
-
SHA1
553b14986aee9a73522ae92a63a77b371f71ba2a
-
SHA256
216b1b3fc0600162c188212f9058937a2b51b211e2ed31cb582283b32c23be49
-
SHA512
63b2983e9fbbe4d2b77e196dd7e1747bc62356fff675143579d6a9e689842e2ad54312b6db4c5008f7b10e7cd250ca1424173c29da15afaa121fd20d8e812acf
-
SSDEEP
96:99LFlZurOe6YBXMdQjdVY161udpa7dGmA/DxbR:9zurv6YSQjd+HpaBGmgDxbR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2bd3837425a96880afb0a05770a5499b_JaffaCakes118
Files
-
2bd3837425a96880afb0a05770a5499b_JaffaCakes118.sys windows:5 windows x86 arch:x86
6b309d6183782aabbcc154ce4a52531d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ObReferenceObjectByHandle
PsCreateSystemThread
PsTerminateSystemThread
ExFreePoolWithTag
ExAllocatePoolWithTag
DbgPrint
KeWaitForSingleObject
IoCreateSymbolicLink
IoCreateDevice
IoDeleteSymbolicLink
IofCompleteRequest
ObfDereferenceObject
PsLookupProcessByProcessId
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
hal
KfRaiseIrql
KeGetCurrentIrql
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 256B - Virtual size: 183B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 640B - Virtual size: 566B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 256B - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE