C:\3\amdk8\Driver\objfre\i386\amdk8.pdb
Static task
static1
1 signatures
General
-
Target
2e9471835dd5818eab7fee5168ee1630_JaffaCakes118
-
Size
8KB
-
MD5
2e9471835dd5818eab7fee5168ee1630
-
SHA1
b4d623bfbbf5792ede39b5fb471da30b34252aed
-
SHA256
6f0258411539b405d6a9aeef5a226fcf36b04ec49523b09368d032ecc22b94c4
-
SHA512
6e3193884febc66edf00b15ded82e5d9f5ea5f7d11e4c25c9399eb73cee8aca3fb19a5c5b394ff2a4c1ec0c72b223f0db220b54ce7a38a2a524222e2203a43ce
-
SSDEEP
96:fIW3tXOlEKp4WT3ZiAN9Yxl+N9k+oC0Fg5ZPfTX3aJtwpWVlCfgfaIqn8r0g:f3olEKWWTpiFop00NbaEpW/sIqn8gg
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2e9471835dd5818eab7fee5168ee1630_JaffaCakes118
Files
-
2e9471835dd5818eab7fee5168ee1630_JaffaCakes118.sys windows:5 windows x86 arch:x86
8659e2ae29aa6632ff3e70530ddbc625
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
KeInitializeEvent
IoCreateDevice
InterlockedDecrement
IofCompleteRequest
ExFreePool
KeSetEvent
KeWaitForSingleObject
IofCallDriver
InterlockedIncrement
IoIsWdmVersionAvailable
RtlCopyUnicodeString
ExAllocatePoolWithTag
ZwClose
ZwSetValueKey
wcslen
ZwCreateKey
DbgPrint
RtlAppendUnicodeToString
RtlInitUnicodeString
KeDetachProcess
ZwTerminateProcess
KeAttachProcess
IoAttachDeviceToDeviceStack
MmUnmapViewOfSection
PsLookupProcessByProcessId
KeServiceDescriptorTable
ProbeForWrite
ProbeForRead
RtlFreeUnicodeString
IoSetDeviceInterfaceState
PoCallDriver
PoStartNextPowerIrp
InterlockedExchange
KeClearEvent
KeInitializeSpinLock
_except_handler3
IoRegisterDeviceInterface
IoDetachDevice
ObfDereferenceObject
IoDeleteDevice
hal
KfReleaseSpinLock
KfAcquireSpinLock
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 640B - Virtual size: 542B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ