d:\工作\暴风ddosvip090112\专业版\ssdt\i386\SSDT.pdb
Static task
static1
General
-
Target
3baa9543db059ec2e482d59cf8d112c8_JaffaCakes118
-
Size
3KB
-
MD5
3baa9543db059ec2e482d59cf8d112c8
-
SHA1
f7f51e2e946f903d3aa5f6f241dd46056aa088ce
-
SHA256
d4371634dd8cf37264a5610cd3dbf2366b44701b1cee60218ec15a0341ff450e
-
SHA512
01e859e648a9a28d3749ab91ebb6e7b79eb4a5cef62bb80871239b06b0c13f015147d67a6483774fd08bd0a83c27d7ec99f0d440d029fca83b7a19e245afe184
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3baa9543db059ec2e482d59cf8d112c8_JaffaCakes118
Files
-
3baa9543db059ec2e482d59cf8d112c8_JaffaCakes118.sys windows:5 windows x86 arch:x86
8e895def0ebdef80b98d8344a8339a81
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IofCompleteRequest
KeServiceDescriptorTable
DbgPrint
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
KeTickCount
Sections
.text Size: 512B - Virtual size: 404B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 159B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 512B - Virtual size: 354B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 110B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ