c:\g\r\objfre_wxp_x86\i386\ster.pdb
Static task
static1
General
-
Target
3d8fb8ad9808b0f952b952736c296a7b_JaffaCakes118
-
Size
11KB
-
MD5
3d8fb8ad9808b0f952b952736c296a7b
-
SHA1
ab432b5de719e651dc629fe403cb34b6a57b21d0
-
SHA256
c65cf1e17729163f552d2766167257dc52f251ba1d920e2505c41d917c8ea3fa
-
SHA512
3b2e3901c09d8e24f25d794fe19add32cc7f75cf909ec9d5bca47646a5f700d9a4a55875b4efa0f7a52af75ba2039dfbfcc0a38c7b2dd33eeda110120e457620
-
SSDEEP
192:oJyPrs162i+PTpf4MXiCKyBZ92htEsrloXdLm:o4PY1rN4m7KycUsrloXd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3d8fb8ad9808b0f952b952736c296a7b_JaffaCakes118
Files
-
3d8fb8ad9808b0f952b952736c296a7b_JaffaCakes118.sys windows:5 windows x86 arch:x86
abd4d13c37eea11d3760189cebc2ee9e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
wcslen
ZwClose
ExAllocatePoolWithTag
ZwQueryValueKey
ZwOpenKey
ExFreePoolWithTag
RtlCompareMemory
_stricmp
IofCompleteRequest
IoFreeMdl
MmUnmapLockedPages
ObfDereferenceObject
IoGetDeviceObjectPointer
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
KeServiceDescriptorTable
MmGetSystemRoutineAddress
KeTickCount
KeBugCheckEx
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 640B - Virtual size: 596B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 640B - Virtual size: 530B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ