D:\Mcafee\VirusScan\sz\i386\szdrv.pdb
Static task
static1
General
-
Target
39cc98c1b7d20f763db5df1d1d678fc4_JaffaCakes118
-
Size
3KB
-
MD5
39cc98c1b7d20f763db5df1d1d678fc4
-
SHA1
08f207d000a96924929d6c2d849cc5d291bfe957
-
SHA256
fdf54363781e833fd30b83353158837eeddc73315f663ef2bf55fd06d92ba8e7
-
SHA512
68cb4631402487ab75082eaa7f03c099cc2d8662a9f24c12befeb48eaf132c2e8cf756e2d3c09b44d95385d18a9c8f6cf70b6886d6ae527c6cb054799b8c5e0f
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 39cc98c1b7d20f763db5df1d1d678fc4_JaffaCakes118
Files
-
39cc98c1b7d20f763db5df1d1d678fc4_JaffaCakes118.sys windows:5 windows x86 arch:x86
07056b63db5e643a6db1b3cf823b3134
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IofCompleteRequest
RtlFreeAnsiString
strncpy
RtlUnicodeStringToAnsiString
ObQueryNameString
KeDetachProcess
ObfDereferenceObject
ObReferenceObjectByHandle
KeAttachProcess
PsLookupProcessByProcessId
ZwClose
ZwSetInformationProcess
ZwDuplicateToken
ZwOpenProcessToken
ZwOpenProcess
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 186B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 640B - Virtual size: 562B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ