D:\maofang\benz\SYS\objfre\i386\KILLKB.pdb
Static task
static1
General
-
Target
2bf5b732325c545b025eb99d73790990_JaffaCakes118
-
Size
5KB
-
MD5
2bf5b732325c545b025eb99d73790990
-
SHA1
33e91e013af356bccdc1492d6e67e3f5ebfcd1cf
-
SHA256
220f95ea38df7fe34ff9567a5038c1d3a7950a743e8587207f4150ac10207a42
-
SHA512
f088140653f756883ef0655eafc2d0d82e809a5fd3f57b84acf25529e0f0d4b32b649aa6e5bac7ebd13a8b39d20b2c899c9e4532f8232cd66909f0a15ce47cd7
-
SSDEEP
48:iZGpgu5XYw6WEuqyEXlBPnjZbiFpMRqVlVdA66bUVtRrgD:wu5XYEqyEXrntbQ5A61gD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2bf5b732325c545b025eb99d73790990_JaffaCakes118
Files
-
2bf5b732325c545b025eb99d73790990_JaffaCakes118.sys windows:5 windows x86 arch:x86
8d7ea1d63197dfde206cf46bb1ff92bd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
RtlInitUnicodeString
IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
ZwOpenProcess
PsProcessType
ZwClose
ZwAssignProcessToJobObject
ZwCreateJobObject
ZwTerminateJobObject
KeServiceDescriptorTable
IoCreateSymbolicLink
IoCreateDevice
_except_handler3
_stricmp
ObReferenceObjectByHandle
hal
KfLowerIrql
KeRaiseIrqlToDpcLevel
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 207B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 640B - Virtual size: 534B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ