cdrom.pdb
Static task
static1
1 signatures
General
-
Target
3a355c681b4cfb2b7dc25bdc73c408ec_JaffaCakes118
-
Size
61KB
-
MD5
3a355c681b4cfb2b7dc25bdc73c408ec
-
SHA1
9fe76b260c71f2fcc6ef6caa2cd3e7a4d95a8e2e
-
SHA256
2aa9e53bfd60a5286aacfe35dfe4e0eca70950900a163b2ae59cbff722bc3179
-
SHA512
649ec1fd93658165ef6e752b7a9002ab199883dae3f7954870389c9e2918fc383c3edc8fbb3775f9699149b7a302c2d1c3fc396ebf409963c3350881f6774bf5
-
SSDEEP
1536:xxY6E/OU1rQzm/P174HlqV17EjmwzYVmcsv:xj/U1rQ6F74HQV7YYVmcsv
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a355c681b4cfb2b7dc25bdc73c408ec_JaffaCakes118
Files
-
3a355c681b4cfb2b7dc25bdc73c408ec_JaffaCakes118.sys windows:5 windows x86 arch:x86
f509526c57659135a7b9400d79e03340
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IoSetHardErrorOrVerifyDevice
_allshr
MmLockPagableDataSection
KeDelayExecutionThread
_allmul
IoSetDeviceInterfaceState
IoRegisterDeviceInterface
RtlGetVersion
KeInitializeSpinLock
MmUnlockPagableImageSection
RtlFreeUnicodeString
IoSetStartIoAttributes
strchr
memmove
_allshl
IoFreeWorkItem
IoReportTargetDeviceChangeAsynchronous
KeReleaseMutex
_aullshr
KeTickCount
ZwCreateKey
KeBugCheckEx
IoGetAttachedDeviceReference
ObfDereferenceObject
IoGetDriverObjectExtension
sprintf
IoAttachDeviceToDeviceStack
IoDeleteDevice
KeInitializeMutex
KeSetEvent
KeClearEvent
IoReuseIrp
KeInitializeEvent
IofCompleteRequest
KeEnterCriticalRegion
KeWaitForSingleObject
KeLeaveCriticalRegion
IoStartPacket
IoAllocateWorkItem
IoQueueWorkItem
RtlWriteRegistryValue
IoOpenDeviceRegistryKey
RtlQueryRegistryValues
ZwClose
swprintf
IoCreateSymbolicLink
IoDeleteSymbolicLink
IoAllocateIrp
IoAllocateMdl
MmBuildMdlForNonPagedPool
IoFreeMdl
IoFreeIrp
ExAllocatePoolWithTag
IoBuildAsynchronousFsdRequest
ExFreePoolWithTag
IofCallDriver
IoGetConfigurationInformation
IoWMIRegistrationControl
RtlInitUnicodeString
WmiQueryTraceInformation
WmiTraceMessage
IoAllocateDriverObjectExtension
IoStartNextPacket
hal
KfRaiseIrql
KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql
KeRaiseIrqlToDpcLevel
KfLowerIrql
classpnp.sys
ClassGetVpb
ClassDisableMediaChangeDetection
ClassFindModePage
ClassSpinDownPowerHandler
ClassInitialize
ClassDeleteSrbLookasideList
ClassGetDriverExtension
ClassInitializeSrbLookasideList
ClassQueryTimeOutRegistryValue
ClassReadDriveCapacity
ClassInitializeMediaChangeDetection
ClassGetDeviceParameter
ClassSetDeviceParameter
ClassResetMediaChangeTimer
ClassScanForSpecial
ClassReleaseQueue
ClassBuildRequest
ClassSplitRequest
ClassClaimDevice
ClassCreateDeviceObject
ClassUpdateInformationInRegistry
ClassInterpretSenseInfo
ClassEnableMediaChangeDetection
ClassIoComplete
ClassSendSrbAsynchronous
ClassSendSrbSynchronous
ClassSendDeviceIoControlSynchronous
ClassAsynchronousCompletion
ClassSendStartUnit
ClassAcquireRemoveLockEx
ClassReleaseRemoveLock
ClassCompleteRequest
ClassDeviceControl
Sections
.text Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEHIT2 Size: 128B - Virtual size: 101B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEHITA Size: 512B - Virtual size: 406B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGETOSH Size: 640B - Virtual size: 536B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 384B - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 984B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ