D:\Homework\Work20090122\Wis080927\objchk\i386\dcpidesk.pdb
Static task
static1
1 signatures
General
-
Target
3a5f64643a27400b31baf9426e394c2a_JaffaCakes118
-
Size
144KB
-
MD5
3a5f64643a27400b31baf9426e394c2a
-
SHA1
aedf45cdaa1782448aec30b9c9efe637bc2bd88d
-
SHA256
ba510457df2c171e701cdb3acfe5c574ffcdba26b670ff8674e636c4165bf3b4
-
SHA512
b8fc35a5992c89de665dbe11c7b977c993336019a981257a65036edf93a32d06fe8058762e524d5ad8d4ec1265df1d335990c346e80a8c4cd19b740046a03a08
-
SSDEEP
3072:MyuDQfH/9YU6M+pWTIkBWDSuoEGHrmOpKuozYK3civsrpJr7k:TuDQP/OU6S8d1+KOEZzGivso
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a5f64643a27400b31baf9426e394c2a_JaffaCakes118
Files
-
3a5f64643a27400b31baf9426e394c2a_JaffaCakes118.sys windows:5 windows x86 arch:x86
72482443bf6bfa1a1683e54ef4b131d3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
_stricmp
IoGetCurrentProcess
ZwClose
ZwWriteFile
ZwCreateFile
RtlInitUnicodeString
wcscat
wcscpy
IoDeleteDevice
MmGetSystemRoutineAddress
ExFreePoolWithTag
ZwReadFile
ExAllocatePoolWithTag
ZwQueryInformationFile
ZwOpenFile
ZwQueryValueKey
ZwOpenKey
PsCreateSystemThread
PsGetVersion
strncmp
ZwMapViewOfSection
ZwCreateSection
ZwUnmapViewOfSection
IoDeleteSymbolicLink
PsSetCreateProcessNotifyRoutine
IofCompleteRequest
KeWaitForSingleObject
MmUnlockPages
KeInsertQueueApc
KeInitializeApc
KeInitializeEvent
KeUnstackDetachProcess
MmMapLockedPagesSpecifyCache
KeStackAttachProcess
IoFreeMdl
MmProbeAndLockPages
IoAllocateMdl
_except_handler3
KeSetEvent
ZwAllocateVirtualMemory
KeClearEvent
IoCreateNotificationEvent
ObfDereferenceObject
PsLookupProcessByProcessId
IoCreateDevice
Exports
Exports
?JitKetPrleTheSystem10@@YGHXZ
?JitKetPrleTheSystem11@@YGHXZ
?JitKetPrleTheSystem1@@YGHXZ
?JitKetPrleTheSystem2@@YGHXZ
?JitKetPrleTheSystem3@@YGHXZ
?JitKetPrleTheSystem4@@YGHXZ
?JitKetPrleTheSystem5@@YGHXZ
?JitKetPrleTheSystem6@@YGHXZ
?JitKetPrleTheSystem7@@YGHXZ
?JitKetPrleTheSystem8@@YGHXZ
?JitKetPrleTheSystem9@@YGHXZ
?JitKetPrleTheSystem@@YGHXZ
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 640B - Virtual size: 560B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 640B - Virtual size: 522B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 640B - Virtual size: 608B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ