d:\winddk\wxgm\i386\wxgm.pdb
Static task
static1
General
-
Target
4509534036fb86df997f449f838c2c04_JaffaCakes118
-
Size
7KB
-
MD5
4509534036fb86df997f449f838c2c04
-
SHA1
7d82b919e58c5005ccac5bffebf8e461e90899ef
-
SHA256
36c3b68e64b51412e6ad1ac747cd154d7fb388374c37ed6362ad3ead37f093b3
-
SHA512
841cb1ecdaf6a2ff02a10a70e5c1c814da7bd7b67c23425879046b550252a227ed6f72929df34af1f52f2a4a3cdaa2932c33a4217e1e9d7a0905b8b490df778a
-
SSDEEP
96:cjjvHIZnldKjLaKu6L83WMJzu6fF/EZf+0UYfR2HD2GNOr/1M:TlcLaKu6L8GmfFcZf+0UcO41
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4509534036fb86df997f449f838c2c04_JaffaCakes118
Files
-
4509534036fb86df997f449f838c2c04_JaffaCakes118.sys windows:5 windows x86 arch:x86
b121b8a33aadecda4d7f4ecdd3891111
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IofCompleteRequest
KeWaitForSingleObject
KeResetEvent
KeInitializeEvent
NtBuildNumber
ZwEnumerateValueKey
ZwEnumerateKey
ZwOpenKey
ZwQueryDirectoryFile
ZwDeviceIoControlFile
ZwQuerySystemInformation
KeServiceDescriptorTable
strncmp
IoGetCurrentProcess
strncpy
RtlCopyUnicodeString
ExFreePool
ExAllocatePoolWithTag
RtlFreeUnicodeString
RtlUpcaseUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlInitUnicodeString
memmove
RtlCompareUnicodeString
KeTickCount
KeBugCheckEx
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 193B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 384B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 896B - Virtual size: 772B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 388B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ