e:\0soft_v03\loader\rootkit\v1.0\driver\objfre_wxp_x86\i386\drive4.pdb
Static task
static1
General
-
Target
4769e3ed7012ae050f4eac9de91868f1_JaffaCakes118
-
Size
29KB
-
MD5
4769e3ed7012ae050f4eac9de91868f1
-
SHA1
3a80cde8b69a94a72847bc24d594cb5cba772830
-
SHA256
64264cca5b3db750c2b11d150c492b580d126c53337f446edb0af3e2a281a6d7
-
SHA512
bfedc1d66034816b7bb070a1cf221fb7abe90462be5678f96eaf5066a33d205aa5bc29085c39ff8e0619755237d5b35d17dec9b3f7634baa4974cf386f083dea
-
SSDEEP
768:gAOSoVx/v7s+XgpzEmtXQJyE83PaLMqglF5vZY:g5Vx7vXgKmadaaN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4769e3ed7012ae050f4eac9de91868f1_JaffaCakes118
Files
-
4769e3ed7012ae050f4eac9de91868f1_JaffaCakes118.sys windows:6 windows x86 arch:x86
33640dfc5983dcf219780b0d2aa74b3e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
NtBuildNumber
RtlInitUnicodeString
memset
PsLookupProcessByProcessId
IofCompleteRequest
ExFreePoolWithTag
ZwClose
ZwWriteFile
ZwCreateFile
ExAllocatePool
DbgPrint
_except_handler3
memcpy
PsSetCreateProcessNotifyRoutine
IoCreateSymbolicLink
IoCreateDevice
ZwQuerySystemInformation
ObReferenceObjectByHandle
ZwOpenThread
ObfReferenceObject
ObfDereferenceObject
IoFreeMdl
KeInsertQueueApc
KeInitializeApc
KeUnstackDetachProcess
MmMapLockedPagesSpecifyCache
KeStackAttachProcess
MmProbeAndLockPages
wcsncmp
ObOpenObjectByName
wcsstr
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
ZwQueryDirectoryObject
ZwOpenDirectoryObject
KeReleaseMutex
KeWaitForSingleObject
ExAllocatePoolWithTag
MmIsAddressValid
IoRegisterFsRegistrationChange
KeInitializeMutex
IoAllocateMdl
hal
KfLowerIrql
KfRaiseIrql
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 460B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 896B - Virtual size: 878B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ