D:\免费版本\暗组免费专版\PcHide\objfre\i386\vbnxqwwer.pdb
Static task
static1
General
-
Target
358b007bd871ffe94debc3e9bba64a4e_JaffaCakes118
-
Size
5KB
-
MD5
358b007bd871ffe94debc3e9bba64a4e
-
SHA1
20ca8b29def7b4cc4dc36749c9166573c7a61554
-
SHA256
8c478fe76731af53aa1a081a320e8e93375e8a9c7c9b3afe650720e249d97409
-
SHA512
36d28a121d4e4dded604c0cf333fd1ea134ec12888080d544a3af5cc351ec0e3a33af9dfb67f9ec50660d873ceab406dd168b6d009baed2fc6a7da83582ed97a
-
SSDEEP
96:EBtcoQo1FLkdF8Rt6CQJUuU5lQyxqa3MC6:ktcoQo1FLkdFA6CQJFDcWP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 358b007bd871ffe94debc3e9bba64a4e_JaffaCakes118
Files
-
358b007bd871ffe94debc3e9bba64a4e_JaffaCakes118.sys windows:5 windows x86 arch:x86
3325a1a4fcabd2c615283d9ae29fc5b0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
RtlFreeAnsiString
RtlCompareMemory
RtlUpperString
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
PsGetCurrentProcessId
ZwQueryDirectoryFile
ZwDeviceIoControlFile
IoDeleteDevice
IoDeleteSymbolicLink
wcscat
RtlFreeUnicodeString
wcscpy
RtlAnsiStringToUnicodeString
IofCompleteRequest
KeServiceDescriptorTable
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 640B - Virtual size: 560B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 640B - Virtual size: 526B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 128B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 256B - Virtual size: 214B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ